Incident Identification

["Frank Reid" <fcreid () ourcorner org>]

I'm seeing a pattern of these alerts against a few hosts (destination port
tcp 53) and, it appears, a payload of nulls.  Does anyone know whether these
occur benignly or whether they're associated with some probe.  Is it
possible they're trying to co-opt DNS services to tunnel through a stateful
inspection firewall?  Thanks!

Frank

BAD TRAFFIC data in TCP SYN packet
IPv4: A.B.C.D-> W.X.Y.Z
      hlen=5 TOS=0 dlen=64 ID=13603 flags=0 offset=0 TTL=244 chksum=18433
TCP:  port=2402 -> dport: 53  flags=******S* seq=2027431866
      ack=0 off=5 res=0 win=2048 urp=0 chksum=46093
Payload:  length = 24

000 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
010 : 00 00 00 00 00 00 00 00                           ........



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users