On Thu, 24 May 2001, DeCamp, Paul wrote: > A SYN/ACK packet is sent to TCP port 53. No SYN was sent from our system. > The SYN & ACK sequence numbers appear to be random, but the ACK is always 1 > less than the SYN. Our system responds with a RST to the ACK. Exactly what you would expect to see if someone sent them a spoofed packet claiming to be from your IP address, source port 53. What are the other port numbers? Now why someone would do that, I can't say. There are some passive fingerprinting techniques this might apply for.. Ryan
This archive was generated by hypermail 2b30 : Fri May 25 2001 - 10:06:59 PDT