Stealth Packets Ok?

["Estes, Matt CPR / FCBS" <Matt.Estes () eis army mil>]

I've had a number of stealth packets consistently since begining monitoring
at this location.  It appears to almost always be between two Win2000
Exchange Servers.  Is this normal?  

Everything from full xmas, null, invalid ack, no-acks, synfin, etc.  All
times of the day, always to port 1050.

If this is normal, when do we get the portscan-ignore-stealth module? :-)

Matt

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users