Re: Is this normal?

[Barrie Dempster <barrie () reboot-robot net>]

On Fri, 2004-10-22 at 12:34 -0300, Joe Polk wrote:
> It's not necessarily unusual. Someone is scanning for open ports and such and
> is attempting to come in. 
<snip>

They most certainly are not, in this case.
You can't scan for open ports if the packets contain a fake return
address like this. In order for the scanning machine to know that a port
is open it requires something to be sent back (ie.. SA). as has been
mentioned before this is most likely a syn flood type attack.

-- 
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Attachment: signature.asc
Description: This is a digitally signed message part