Re: port 0 scanning

From: Lamont Granquist (lamontgat_private)
Date: Thu Jul 09 1998 - 19:20:32 PDT

Next message: David Schwartz: "Re: ncurses 4.1 security bug"

Previous message: matthew green: "Re: ncurses 4.1 security bug"
Maybe in reply to: Lamont Granquist: "port 0 scanning"
Next in thread: Dagmar d'Surreal: "Re: port 0 scanning"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----


As a followup to this, I've been informed by two people now[*] that Linux
boxes will respond to SYN|FIN with a SYN|FIN|ACK on an open port.
Therefore this probably indicates that the SYN|FIN packets were not only
an attempt to get past poorly designed firewalls, but probably an attempt
to ID the system being probed as a Linux box as well.

[*] Solar Designer and John McDonald

- --
Lamont Granquist <lamontgat_private> (206)616-1469 fax:(206)543-5380
Human Interface Technology Lab.  University of Washington.  Seattle, WA
PGP pubkey: finger -l lamontgat_private | pgp -fka

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNaV6dCGfPhFbK8mBAQG6owP9E/2Grcjna9BYVnWbcAM4jZ0S8I3Xlv3z
et4JcGE1LOE7667txRUdoBFBGT8nveZKT30mKUUrdrpXTSkVjqIV0lmH0o+1UnZm
dRea+7KQveosZjZQlzu6ndAMDB/lfUhSNiFOy4E18Vnrs8HNlxxwS4UJoCUYYpLg
/HqcjFNaexs=
=5RnL
-----END PGP SIGNATURE-----

Next message: David Schwartz: "Re: ncurses 4.1 security bug"
Previous message: matthew green: "Re: ncurses 4.1 security bug"
Maybe in reply to: Lamont Granquist: "port 0 scanning"
Next in thread: Dagmar d'Surreal: "Re: port 0 scanning"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:02:58 PDT