Snort mailing list archives
SV: BAD TRAFFIC data in TCP SYN packet
From: Lars Jørgensen IT <Lars.Jorgensen () pol dk>
Date: Mon, 14 Jan 2002 22:13:48 +0100
Got similar and they resolved to something.windowsupdate.com. I am
wondering
if this has anything to do with windows XP and it's auto-update features.
It goes to my DNS server on port 53, and that server is a windows 2000 box. I doubt microsoft's update-protocol would use DNS-port for updates. Lars _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- BAD TRAFFIC data in TCP SYN packet Lars Jørgensen IT (Jan 13)
- Re: BAD TRAFFIC data in TCP SYN packet Chris Keladis (Jan 13)
- Re: BAD TRAFFIC data in TCP SYN packet Matt Kettler (Jan 14)
- Re: BAD TRAFFIC data in TCP SYN packet Dewey Paciaffi (Jan 14)
- Re: BAD TRAFFIC data in TCP SYN packet Martin Roesch (Jan 14)
- Re: BAD TRAFFIC data in TCP SYN packet Laurie Zirkle (Jan 15)
- <Possible follow-ups>
- Re: BAD TRAFFIC data in TCP SYN packet Tudor Panaitescu (Jan 14)
- SV: BAD TRAFFIC data in TCP SYN packet Lars Jørgensen IT (Jan 14)
- Re: SV: BAD TRAFFIC data in TCP SYN packet Matt Kettler (Jan 14)
- Re: SV: BAD TRAFFIC data in TCP SYN packet Dan Hollis (Jan 14)
- Re: SV: BAD TRAFFIC data in TCP SYN packet Matt Kettler (Jan 14)
- RE: SV: BAD TRAFFIC data in TCP SYN packet Austad, Jay (Jan 15)
- RE: SV: BAD TRAFFIC data in TCP SYN packet Dan Hollis (Jan 15)
- RE: SV: BAD TRAFFIC data in TCP SYN packet Matt Kettler (Jan 15)
- RE: SV: BAD TRAFFIC data in TCP SYN packet Dan Hollis (Jan 15)