Snort mailing list archives
"Reset Cause" payload
From: John Hally <JHally () epnet com>
Date: Wed, 29 Nov 2006 16:20:47 -0500
Hello Everyone, I noticed something in some packet dumps that I haven't seen before. I'm not sure what to make of it. What I'm seeing is an ACK/RST packet with a "Reset Cause" entry that looks like is filled with some errant HTML. It doesn't look nefarious, but it strikes me as odd. A quick look at surrounding packets and he browser agent is Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) and the server is IIS6. Has anyone else seen similar packets and offer an explanation? Thanks! John.
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- "Reset Cause" payload John Hally (Nov 29)