NOACK ****PR**

[Phil Wood <cpw () lanl gov>]

Folks,

I see:

  NOACK ****PR**

generated by the portscan preprocessor based on a packet from an IBM system:

220 xxx.yyy.edu running IBM MVS SMTP CS V2R7 on Tue, 19 Jun 01 15:45:52 PST

Does anyone know if this is just the way IBM implimented the TCP protocol.

I can kind of hear a conversation in the bullpen:

  "Hey, how do you suppose we are supposed to reject an incoming tcp
   connection?"

  "Oh, just push out a reset."

And so it goes.

Thanks,

Phil


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users