[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-users] Testing portscan detection
- Subject: Re: [cobalt-users] Testing portscan detection
- From: flash22@xxxxxxx
- Date: Tue Jul 30 14:08:01 2002
- List-id: Mailing list for users to share thoughts on Sun Cobalt products. <cobalt-users.list.cobalt.com>
On Tue, 30 Jul 2002, Robert Roose wrote:
> Log Entry: eth1:portscan: tcp 192.168.2.12/7 ->
> 192.168.2.50/4630 40 rst (16)
> If I'm reading this correctly the server is doing the scanning instead
> of me. Or am I reading this wrongly?
It's correct, you are probab;y doing a FIN scan, the machine is logging
the reply (ReSeT) packets that it's sending back...
You sort of have to read it in context, scanning with RST's wouldn't
do anything, since they are ignored as far as replies...
gsh