TCP SYS Host Sweep

[DFiore]

Seems like whenever a mail server connects and does a mass mailing to customers I see this sig fire.

I also see the sig fire when "certain" users surf to websites with tracking cookies (DoubleClick, Akamai, etc.)

According to the Sig DB at MySDN, this sig is benign as long as the traffic seen is internal.

Is this the case?

[DFiore]

Any ideas before the weekend?

[mhellman · Accepted solution]

Do you mean TCP SYN Host sweep (3030-0)? I never really found it to be a useful signature, mostly because it doesn't report the port(s) being scanned. It is prone to false positives as well since it will fire on return traffic (like to an HTTP proxy for example). Filtering can fix that if you're so inclined.

see these threads:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddabf56

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB?cmd=pass_through&location=outline@^1@@.1dd99469

[DFiore]

Thanks Matt,

I'll look at the threads and consider filtering out the fires I can explain (proxy server, email, etc.)

Have a good weekend...

David