I am new to SNORT and can not figure out what the following rule means:

alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F;

1 Answer 1


That looks to me like it would alert if it receives traffic from the defined external network ($EXTERNAL_NET) to your defined home network ($HOME_NET) where the TCP fin flag is set on it's own.

This could be taken to indicate a piece of scanning software, as in a standard TCP communication FIN isn't sent on it's own, it goes along with an ACK flack (there's more information here)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .