Re: SYN/ACK to port 53

[Ryan Russell <ryan () securityfocus com>]

On Thu, 24 May 2001, DeCamp, Paul wrote:

> A SYN/ACK packet is sent to TCP port 53.  No SYN was sent from our system.
> The SYN & ACK sequence numbers appear to be random, but the ACK is always 1
> less than the SYN.  Our system responds with a RST to the ACK.

Exactly what you would expect to see if someone sent them a spoofed packet
claiming to be from your IP address, source port 53.  What are the other
port numbers?

Now why someone would do that, I can't say.  There are some passive
fingerprinting techniques this might apply for..

                                        Ryan