TCP XMAS scan
advICE :Intrusions : 2000308

Summary

A TCP frame has been seen with a sequence number of zero and the FIN, URG, and PUSH bits are all set.

Details

This frame should never be seen in normal TCP operation. A hacker may be scanning your system by sending these specially formatted frames to see what services are available. Sometimes this is done in preparation for a future attack, or sometimes it is done to see if your system might have a service which is susceptible to attack.

parametric information port The TCP destination port flags The TCP flags from the offending frame. The flags are: S (SYN), F (FIN), R (RESET), P (PUSH), A (ACK), U (URGENT), 4 (low-order unused bit), 8 (high-order unused bit) options The TCP options from the offending frame. The options are displayed as "option-value", separated by commas. No-ops are not displayed

 
Version appeared: 1.8.5.5