Re: [Snort-users] TCP session without 3-way handshake

[Dorian ROSSE via Snort-sigs <snort-sigs () lists snort org>]

Hello,


This user has an alert :


TCP session without 3-way handshake [Classification: Potentially Bad Traffic] [Priority: 2]

They are coming from many international IP addresses on port 443.

He want to know if it is a bad happening this alert?

Thank you in advance for your time,

Regards.


Dorian Rosse.

Get Outlook for Android<https://aka.ms/ghei36>
________________________________
From: Dorian ROSSE <dorianbrice () hotmail fr>
Sent: Sunday, August 9, 2020 4:34:56 PM
To: clive.bandoo () talk21 com <clive.bandoo () talk21 com>; snort-users () lists snort org <snort-users () lists snort 
org>; snort-sigs () lists snort org <snort-sigs () lists snort org>
Subject: Re: [Snort-users] TCP session without 3-way handshake

Hello,


All rules questions is on snort sigs mailer,

Sorry,

Regards.


Dorian Rosse.

Get Outlook for Android<https://aka.ms/ghei36>
________________________________
From: Snort-users <snort-users-bounces () lists snort org> on behalf of clive.bandoo--- via Snort-users <snort-users () 
lists snort org>
Sent: Sunday, August 9, 2020 3:54:38 PM
To: snort-users () lists snort org <snort-users () lists snort org>
Subject: [Snort-users] TCP session without 3-way handshake


Hi



I am getting a lot of these messages (by the second) TCP session without 3-way handshake [Classification: Potentially 
Bad Traffic] [Priority: 2]

They are coming from many international IP addresses on port 443.


a) is this an issue or is it attempts being blocked?


b) if it is not an Issue how do I stop logging?


Thanks in advance

Clive

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!