Messages in this thread | | | Date | Thu, 10 Dec 1998 17:40:37 +0000 | From | Jamie Lokier <> | Subject | Re: Logging unserved ports |
| |
On Tue, Dec 08, 1998 at 11:06:34PM -0500, linux-kernel@progressive-comp.com wrote: > Actually I cloned this functionality in a kernel patch a while back, for > pretty much the same reason you're looking (got used to the TIS fw logging > of unserved ports, and missed it). I also added detection of bad/invalid > TCP flag combinations (such as RST+SYN, FIN+SYN, etc). It detects, ^^^^^^^ > confuses, and/or defeats a number of stealth scanning or stack- > identification tools such as nmap, queso, etc. I make no claims that it's > perfect, or cleanly done (or that it works at all, for that matter ;).
FIN+SYN is valid under some circumstances, is it not?
-- Jamie
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |