Hosting Provided By

Re: Port 0 packets

From: Andreas Östling <andreaso(at)it.su.se>
Date: Fri Jul 25 2003 - 14:18:38 EDT

On Thu, 24 Jul 2003, Dave Paris wrote:

> Our IDS spotted another TCP port 0 packet at 19:59pm UTC today

In case you don't know, snort has a bug (or had - I don't know if it has been fixed now) that would make those alerts generated by the snort decoder to always have the ports set to 0 since those values weren't yet assigned at that stage.
See http://marc.theaimsgroup.com/?l=snort-devel&m=105698697005259&w=2

/Andreas

Received on Sun Jul 27 15:24:16 2003

This message: [ Message body ]
Next message: Jason Falciola: "Re: www.google.com reference in directory-traversal attack"
Previous message: Robin Lynn Frank: "Is this enough to identify this by?"
In reply to: Dave Paris: "Re: Port 0 packets"
In reply to Stuart: "RE: Port 0 packets"
Next in thread: Dave Paris: "Re: Port 0 packets"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:13 EDT