0

I am new to SNORT and can not figure out what the following rule means:

alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F;
reference:arachnids,27;
1

That looks to me like it would alert if it receives traffic from the defined external network ($EXTERNAL_NET) to your defined home network ($HOME_NET) where the TCP fin flag is set on it's own.

This could be taken to indicate a piece of scanning software, as in a standard TCP communication FIN isn't sent on it's own, it goes along with an ACK flack (there's more information here)

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.