So, Oprano is running Port Scans....Why ?

[sarettah]

Originally posted by gonzo@Apr 2 2004, 10:41 PM
Bishop was telling me the same thing last week which he reset his stuff and it went away. Is it on the radio page? Or when you click?

Neither of them that I am aware of.......


from: http://www.whitehats.com/cgi/arachNIDS/Sho...s144&view=event

IDS144 "PROBE-FULL_XMAS_SCAN"
Platform(s): unix windows device
Category: scan
Classification: Information Gathering Attempt

This event indicates that an intruder is scanning your computer for available TCP services by sending "Xmas-tree" packets. These packets have the a sequence number of zero and the SYN, FIN, ACK, URG, PSH, and RST flags set. This packet should never be seen in normal TCP operation.

How Specific

This event is specific to a vulnerability, but may have been caused by any of several possible exploits. Packet payload is not considered in the signatures used to detect this attack.

Trusting The Source IP Address

Although this event was caused by a TCP packet, the packet is not thought to be a part of an existing TCP session. Therefor the source IP address could be easily forged. It has been noted that the intruder is likely to expect or desire a response to their packets, so it may be likely that the source IP address is not spoofed.

False Positives

There are reported incidents where legitimate traffic may cause an intrusion detection system to raise "false positive" alerts for this event.

The following details have been reported:

With the ack set to zero, and these options, the packet is almost guaranteed to not occur naturally.