topic Re: TCP SYS Host Sweep in Network Security

TCP SYS Host Sweep

DFiore — Sun, 10 Mar 2019 10:08:48 GMT

Seems like whenever a mail server connects and does a mass mailing to customers I see this sig fire.

I also see the sig fire when "certain" users surf to websites with tracking cookies (DoubleClick, Akamai, etc.)

According to the Sig DB at MySDN, this sig is benign as long as the traffic seen is internal.

Is this the case?

Re: TCP SYS Host Sweep

DFiore — Fri, 04 Aug 2006 14:55:16 GMT

Any ideas before the weekend?

Re: TCP SYS Host Sweep

mhellman — Fri, 04 Aug 2006 15:13:30 GMT

Do you mean TCP SYN Host sweep (3030-0)? I never really found it to be a useful signature, mostly because it doesn't report the port(s) being scanned. It is prone to false positives as well since it will fire on return traffic (like to an HTTP proxy for example). Filtering can fix that if you're so inclined.

see these threads:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddabf56

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB?cmd=pass_through&location=outline@^1@@.1dd99469

Re: TCP SYS Host Sweep

DFiore — Fri, 04 Aug 2006 17:41:19 GMT

Thanks Matt,

I'll look at the threads and consider filtering out the fires I can explain (proxy server, email, etc.)

Have a good weekend...

David