In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be "detected" as belonging to the SYN scan because the rate of change would remain constant. But when a SYN scan is happening, the rate of change is high. I don't fully understand why it is really any higher, I get that the person scanning is sending small raw packets to multiple ports and thus the victim host is in a small instant sending back many responses.

So I guess say you are poking 200 ports simultaneously, sending say raw packets of size 20 to each port, your rate of change is 4000. How come you can't attempt to upload a file at that same rate? I guess what I don't get is why this rate of change is restricted for large files but not for many small files equaling the same size essentially.

1 Answer 1


When you're performing a syn scan, most ports are going to have one of two results. If the port is firewalled and configured to silently drop, no packets will be returned for most ports, so you'll see very close to 0/t packets returned. If you aren't silently dropping you will see 1 RST packet for every SYN. You will have very close to a 1:1 ratio of sent to received.

If you do a large file upload via TCP, the connection will be ACKd every w packets, where w is the size of the tcp window, so you will have very close to a 1/w sent to received packet ratio, where normally w << t.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .