Quote:
Originally posted by gonzo@Apr 2 2004, 10:41 PM
Bishop was telling me the same thing last week which he reset his stuff and it went away. Is it on the radio page? Or when you click?
|
Neither of them that I am aware of.......
from:
http://www.whitehats.com/cgi/arachNIDS/Sho...s144&view=event
IDS144 "PROBE-FULL_XMAS_SCAN"
Platform(s): unix windows device
Category: scan
Classification: Information Gathering Attempt
This event indicates that an intruder is scanning your computer for available TCP services by sending "Xmas-tree" packets. These packets have the a sequence number of zero and the SYN, FIN, ACK, URG, PSH, and RST flags set. This packet should never be seen in normal TCP operation.
How Specific
This event is specific to a vulnerability, but may have been caused by any of several possible exploits. Packet payload is not considered in the signatures used to detect this attack.
Trusting The Source IP Address
Although this event was caused by a TCP packet, the packet is not thought to be a part of an existing TCP session. Therefor the source IP address could be easily forged. It has been noted that the intruder is likely to expect or desire a response to their packets, so it may be likely that the source IP address is not spoofed.
False Positives
There are reported incidents where legitimate traffic may cause an intrusion detection system to raise "false positive" alerts for this event.
The following details have been reported:
With the ack set to zero, and these options, the packet is almost guaranteed to not occur naturally.