topic Prevent Stealth Scans in Network Security https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771963#M1008536 <P>What is the best defense against stealth scans of the network? I know this is a vague and open question.</P><P></P><P>How do you prevent when signature detects a single TCP packet with none of the control bits, i.e. SYN, FIN, ACK, PSH, URG or RST flags set being sent to a specific host.</P> Mon, 11 Mar 2019 09:54:41 GMT cplatt01 2019-03-11T09:54:41Z Prevent Stealth Scans https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771963#M1008536 <P>What is the best defense against stealth scans of the network? I know this is a vague and open question.</P><P></P><P>How do you prevent when signature detects a single TCP packet with none of the control bits, i.e. SYN, FIN, ACK, PSH, URG or RST flags set being sent to a specific host.</P> Mon, 11 Mar 2019 09:54:41 GMT https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771963#M1008536 cplatt01 2019-03-11T09:54:41Z Re: Prevent Stealth Scans https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771964#M1008537 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>I'm not sure we are totally following your question. Are you asking specificly to the PIX/ASA/FWSM or a more generic question relating to IPS/IDS?</P><P></P><P>Sincerely,</P><P></P><P>David.</P></BODY></HTML> Mon, 02 Apr 2007 15:55:58 GMT https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771964#M1008537 David White 2007-04-02T15:55:58Z Re: Prevent Stealth Scans https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771965#M1008538 <HTML><HEAD></HEAD><BODY><P>More for the PIX.</P></BODY></HTML> Mon, 02 Apr 2007 15:57:24 GMT https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771965#M1008538 cplatt01 2007-04-02T15:57:24Z Re: Prevent Stealth Scans https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771966#M1008541 <HTML><HEAD></HEAD><BODY><P>The Pix will drop null packets. Any firewall should.</P></BODY></HTML> Mon, 02 Apr 2007 16:12:45 GMT https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771966#M1008541 mhellman 2007-04-02T16:12:45Z Re: Prevent Stealth Scans https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771967#M1008542 <HTML><HEAD></HEAD><BODY><P>The PIX will silently drop these packets (ie: no syslog generated). In 7.x, many of these will get counted in the "show asp drop" output, but again, no syslog generated.</P><P></P><P>David.</P></BODY></HTML> Mon, 02 Apr 2007 16:12:49 GMT https://community.cisco.com/t5/network-security/prevent-stealth-scans/m-p/771967#M1008542 David White 2007-04-02T16:12:49Z