Home page logo
/

educause logo Educause Security Discussion mailing list archives

Re: Data in SYN Packets
From: John Kristoff <jtk () DEPAUL EDU>
Date: Tue, 27 Mar 2007 09:44:50 -0500

On Mon, 26 Mar 2007 14:24:39 -0500
Mike Hanson <MHanson () CSS EDU> wrote:

In our IPS log I see the following entry *TCP C2S Ambiguity: Data in
SYN Packet* daily directed towards our DNS server. These packets are
coming from four or so different addresses in China.  I did a brief
Google search with results being a few or more years old. A couple of
the posts reported the same *Data in SYN Packet* with the
originating addresses also from China.

Can anybody shed light on this?

Mike,

If you still see it coming and can grab some full packet capture samples
of them and don't mind sending them to me I'd like to take a look.

John

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]