Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

(Sorry, had not noticed you report two different signatures).

Signature 3032 is a (possibly harmless if from internal network) scan. If the attack source is outside your perimeter, then treat it as Signature 3036, below. Otherwise, you can safely ignore it.

Signature 3036 is "SYN FIN" host sweep. It means that your system is seeing anomalous packets coming in from the Internet, and there's not much you can do about it except perhaps complaining with the originating networks' system admins... if you can find them.

Such packets are not a risk, in that they have no ill effect on targeted hosts. They can be used to elicit a response and determine what services are running on the target hosts.

You can block inbound traffic from the systems performing such sweeps.

This will stop further activity from those hosts, but unless they're newbies, the scanning hosts and the attacking hosts (if any) will not be the same, possibly not even from the same country. An attacker might use an expendable, broken-into and enslaved system in another country as both scanner and cut-off. Even so, blocking source hosts may be helpful in that the attackers will see that they have been detected, and might decide to bring their custom elsewhere; and if the scanner is itself an exploited system, alerting the administrators will allow them to clean it out. They might even start investigation and prosecution of the responsible parties without any further effort on your part (in some countries, you may count on it; in others, forget it).

You might get some idea of what the attackers are after from the ports they've been targeting, and might want to run an audit of exposed services to assess their vulnerability. But do this for all exposed services: do not rely on the fact that an unscanned port will be left alone.

share|improve this answer
    
Thanx Iserni that was helpful –  Victor Mar 15 '13 at 13:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.