Re: Is this normal?

[Kenneth R Swain II <ken () kenswain com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Oct 27, 2004, at 8:35 AM, Barrie Dempster wrote:

> On Fri, 2004-10-22 at 12:34 -0300, Joe Polk wrote:
> > It's not necessarily unusual. Someone is scanning for open ports and 
> > such and
> > is attempting to come in.
> <snip>
>
> They most certainly are not, in this case.
> You can't scan for open ports if the packets contain a fake return
> address like this. In order for the scanning machine to know that a 
> port
> is open it requires something to be sent back (ie.. SA). as has been
> mentioned before this is most likely a syn flood type attack.
>
> --
> Barrie Dempster (zeedo) - Fortiter et Strenue
>
>   http://www.bsrf.org.uk
>
> [ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Wouldn't the -D option let you do a decoy scan? This would let you make 
a scan look like it is coming from some other place or dummy host.

Ken Swain
mail: ken () kenswain com
im: aim:krswain190
web: kenswain.com
"/dev/geek"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBf9NdTyWvVEql+hsRAo1DAJ0a7EwvkfPHZo72WebXT1+AmsXexQCeL7NQ
huQbf7CLDysqwJ/rBJQUAxo=
=d0cu
-----END PGP SIGNATURE-----