topic Atomic TCP Signatures in Network Security https://community.cisco.com/t5/network-security/atomic-tcp-signatures/m-p/339575#M97439 <P>Can we use an atomic.tcp signature to trigger any event that causes a SYN packet sent to a host? And will it fire if for example we establish a telnet session to the host? (I assure telnet first establishes a TCP session and a SYN should go out at some point).</P> Sun, 10 Mar 2019 09:13:05 GMT khanj 2019-03-10T09:13:05Z Atomic TCP Signatures https://community.cisco.com/t5/network-security/atomic-tcp-signatures/m-p/339575#M97439 <P>Can we use an atomic.tcp signature to trigger any event that causes a SYN packet sent to a host? And will it fire if for example we establish a telnet session to the host? (I assure telnet first establishes a TCP session and a SYN should go out at some point).</P> Sun, 10 Mar 2019 09:13:05 GMT https://community.cisco.com/t5/network-security/atomic-tcp-signatures/m-p/339575#M97439 khanj 2019-03-10T09:13:05Z Re: Atomic TCP Signatures https://community.cisco.com/t5/network-security/atomic-tcp-signatures/m-p/339576#M97441 <HTML><HEAD></HEAD><BODY><P>If you want a signature that fires on any SYN packet being sent to a certain host, you can use the atomic.tcp engine. You will need to write a signature for any packet with the SYN flag set and then use filters to filter out the alarms for the host you are concerned with. If this is not what you are looking for, can you please clarify what you are trying to trigger on.</P></BODY></HTML> Tue, 04 Jan 2005 15:02:04 GMT https://community.cisco.com/t5/network-security/atomic-tcp-signatures/m-p/339576#M97441 micballa 2005-01-04T15:02:04Z