Ethereal-users: RE: [Ethereal-users] RST flag question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Jim Hendrick" <jrhendri@xxxxxxxxxxxx>
Date: Wed, 4 Aug 2004 23:19:38 -0400
Sounds like someone mapping your server with a classic SYN scan (look at
nmap). 

The "client" looks for open services this way. Sending a SYN, waiting for a
SYN/ACK (indicating a listening service) and replying with a RST (not
causing the connection to be opened, which would get logged on the server,
but letting the scanner (client) know that a service is alive and reachable.

Later,
Jim

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Matt Kopf
Sent: Wednesday, August 04, 2004 4:26 PM
To: 'Ethereal user support'
Subject: [Ethereal-users] RST flag question


Doing some monitoring on a network link that goes over a Cisco router I saw
many times where the computer on the other end will start the handshake
process, the server answered and then a RST from the client. So the question
is:

Can the router set the RST flag?

What would cause the OS (windows) to set the RST flag?

Thanks for the help.

Matt Kopf

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users