topic false negative for syn ack scan in Network Security https://community.cisco.com/t5/network-security/false-negative-for-syn-ack-scan/m-p/655542#M88302 <P>Our sensors are false negative on all syn ack scans that are received. Is there a signature current on the ids that will capture the following?</P><P></P><P> 1 2006-11-14 14:27:04.287620 202.103.178.165 my.net.163.77 TCP http &gt; 21129 [SYN, ACK] Seq=0 Ack=0 Win=0 Len=0 MSS=0</P><P>cut</P><P> 10 2006-11-14 14:27:06.868677 202.103.178.165 my.net.251.125 TCP http &gt; 606 [SYN, ACK] Seq=0 Ack=0 Win=0 Len=0 MSS=0</P> Sun, 10 Mar 2019 10:19:27 GMT darin.marais 2019-03-10T10:19:27Z false negative for syn ack scan https://community.cisco.com/t5/network-security/false-negative-for-syn-ack-scan/m-p/655542#M88302 <P>Our sensors are false negative on all syn ack scans that are received. Is there a signature current on the ids that will capture the following?</P><P></P><P> 1 2006-11-14 14:27:04.287620 202.103.178.165 my.net.163.77 TCP http &gt; 21129 [SYN, ACK] Seq=0 Ack=0 Win=0 Len=0 MSS=0</P><P>cut</P><P> 10 2006-11-14 14:27:06.868677 202.103.178.165 my.net.251.125 TCP http &gt; 606 [SYN, ACK] Seq=0 Ack=0 Win=0 Len=0 MSS=0</P> Sun, 10 Mar 2019 10:19:27 GMT https://community.cisco.com/t5/network-security/false-negative-for-syn-ack-scan/m-p/655542#M88302 darin.marais 2019-03-10T10:19:27Z Re: false negative for syn ack scan https://community.cisco.com/t5/network-security/false-negative-for-syn-ack-scan/m-p/655543#M88303 <HTML><HEAD></HEAD><BODY><P>Try these links:</P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/cisintwk/itg_v1/tr1925.htm#xtocid162254" target="_blank">http://www.cisco.com/univercd/cc/td/doc/cisintwk/itg_v1/tr1925.htm#xtocid162254</A></P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/sw/secursw/ps2113/prod_technical_reference09186a00800d9dd5.html" target="_blank">http://www.cisco.com/en/US/products/sw/secursw/ps2113/prod_technical_reference09186a00800d9dd5.html</A></P><P><A class="jive-link-custom" href="http://www.cisco.com/warp/public/63/nimda-ids.html" target="_blank">http://www.cisco.com/warp/public/63/nimda-ids.html</A></P></BODY></HTML> Mon, 20 Nov 2006 14:56:58 GMT https://community.cisco.com/t5/network-security/false-negative-for-syn-ack-scan/m-p/655543#M88303 dsweeny 2006-11-20T14:56:58Z