Security Incidents mailing list archives
any idea of the kiddie-script tool crafting these SYN-FIN packets to user selectable destination ports
From: r4gn4r0k <r4gn4r0k () TELUS NET>
Date: Fri, 19 Jan 2001 00:43:46 -0800
anyone know the name(s) and/or a url to find the tool? may be one tool or family of tools derived from the same base code (note the hand-crafted ID always = 39426 and the Advertised Window = 0x404) I'm trying to correlate what I'm seeing on snort with what my personal firwall is logging and I want to be able to generate the traffic myself (tired of having to wait hours or days between random tests to be farted out of the global sewer). TIA /r Sample TCPDUMP output: 13:48:34.322789 eth0 P 216.94.60.156.ftp > mypc.any.org.ftp: SF 1808792213:1808792213(0) win 1028 (ttl 32, id 39426) Snort Alerts: [**] IDS198 - SCAN-SYN FIN [**] 01/17-13:48:34.322789 216.94.60.156:21 -> mypc.any.org:21 TCP TTL:32 TOS:0x0 ID:39426 ******SF Seq: 0x6BCFFA95 Ack: 0x2A10533A Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/05-12:12:39.719091 63.192.141.74:9704 -> mypc.any.org:9704 TCP TTL:28 TOS:0x0 ID:39426 ******SF Seq: 0x2703CFEA Ack: 0x61CCA06C Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/06-03:56:13.515113 210.97.240.11:53 -> mypc.any.org:53 TCP TTL:30 TOS:0x0 ID:39426 ******SF Seq: 0x6FF04448 Ack: 0x4D87885F Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/06-09:54:25.972394 202.190.201.1:21 -> mypc.any.org:21 TCP TTL:28 TOS:0x0 ID:39426 ******SF Seq: 0x54C519C7 Ack: 0x4D77D9B4 Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/07-01:02:20.752179 62.149.151.160:110 -> mypc.any.org:110 TCP TTL:27 TOS:0x0 ID:39426 ******SF Seq: 0x34FF17B7 Ack: 0x786DB88A Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/07-15:01:54.877206 158.42.57.42:111 -> mypc.any.org:111 TCP TTL:31 TOS:0x0 ID:39426 ******SF Seq: 0x2837B8A6 Ack: 0x2AEF650D Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/13-17:53:45.478701 62.98.137.208:21 -> mypc.any.org:21 TCP TTL:25 TOS:0x0 ID:39426 ******SF Seq: 0x68AEE551 Ack: 0x8A124BE Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/17-20:35:18.211718 64.248.77.18:21 -> mypc.any.org:21 TCP TTL:28 TOS:0x0 ID:39426 ******SF Seq: 0x7B63CDF2 Ack: 0x2917D0D3 Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/18-02:37:35.013479 216.162.96.39:21 -> mypc.any.org:21 TCP TTL:33 TOS:0x0 ID:39426 ******SF Seq: 0x791F0C00 Ack: 0x740815C2 Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/18-02:42:25.382507 64.148.165.60:21 -> mypc.any.org:21 TCP TTL:29 TOS:0x0 ID:39426 ******SF Seq: 0x791F0C00 Ack: 0x740815C2 Win: 0x404 [**] IDS198 - SCAN-SYN FIN [**] 01/18-12:18:37.819176 150.131.108.239:21 -> mypc.any.org:21 TCP TTL:30 TOS:0x0 ID:39426 ******SF Seq: 0x484A23DD Ack: 0x2277E3D Win: 0x404 THE END
Current thread:
- any idea of the kiddie-script tool crafting these SYN-FIN packets to user selectable destination ports r4gn4r0k (Jan 19)