2000307

	TCP short header
advICE :Intrusions : 2000307

FAQ

Oh my gosh, I'm being HACKED!!!

How do I report the hacker to my ISP?

I'm seeing lots of attacks, is this normal?

Summary
A frame containing a short TCP header has been seen. This sometimes occurs when a hacker has attempted to split a TCP header into multiple fragments, but has done so incorrectly.
Details
A hacker may be scanning your system to see what services are available. This frame should never be seen in formal TCP operation. Sometimes this is done in preparation for a future attack, or sometimes it is done to see if your system might have a service which is susceptible to attack.
Most older versions of the BeOS operating system can be crashed with this technique.

more information

advICE: port scan: Explains port scanning in depth, and describes the various types of port scans.
BugtraqID: 1100 BeOS IP Packet Length Field Vulnerability
CVE-2000-0279 BeOS remote DoS via malformed short packets

parametric information

TCP_length The length of the TCP header

 
Version appeared: 1.8.5.5

TCP short header