TCP reset packet

[Perbo]

Quite often Hackers would send tcp reset packets

is there an Signature for that ??????

cheers

per

[wsulym]

Sounds like you are looking for a signature that fires when something like nmap is trying to fingerprint an OS - sig 3046 would fire on a figerprinting attempt. Would need addt'l detail as to exactly what is going on if you want to narrow down a particular type of attack

'

[mlhall]

There are several different times when an attacker might send RST packets. What are you looking for?

CSIDS does have signatures that use RST as part of the signature, but we don't alarm on every RST. They do have a valid use as well.