Security Incidents mailing list archives

Strange & Consistent RST/ACK packets

From: securityguru () HOTMAIL COM (Security Guru)
Date: Sat, 8 Apr 2000 21:57:17 CDT


At one of my customer sites, I keep seeing uninitated RST/ACK packets with
an acknowledgement number of 674719802.  These packets come from many
different source IP addresses and range from a few packets a day to a few
hundered.  Is there a known 'attacker' tool that generates these SYN or
SYN/ACKS with a sequence number of 674719801?  Or is this just a scanning
tool that looks for ICMP unreachables from my customer's border router?

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

Current thread:

NIPC Worm/Virus Alert Elias Levy (Apr 02)
- Smurf/broadcast "pings" Dennis DeDonatis (Apr 05)
  - Re: Smurf/broadcast "pings" UnixGeek (Apr 06)
  - Another day, another box hacked Jakub Urbanec (Apr 07)
  - Lots of scans on port 27063 Erick Perez (Apr 08)
    - Re: Lots of scans on port 27063 Blake Frantz (Apr 10)
    - Re: Lots of scans on port 27063 James Stevenson (Apr 12)
  - Strange & Consistent RST/ACK packets Security Guru (Apr 08)
    - fragment attack of some kind ? Klavs Klavsen (Apr 11)
    - Re: fragment attack of some kind ? Heiko Degenhardt (Apr 17)
    - Re: Strange & Consistent RST/ACK packets Richard Bejtlich (Apr 11)
    - Re: Strange & Consistent RST/ACK packets Dave Dittrich (Apr 11)