TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
I have recently been investigating a case where ISS has thrown the NMAP
alert across when I know there was no NMAP scan. From the packets I have
captured, there doesn't appear to be any anomalous traffic to correlate with
this event. Has anyone else seen a "false positive" for this alert? To
ISS...Can you tell me exactly what triggers the alert, whether it is the
weird flag combos or something to do with the sequence numbers. I need to
be able to show that this in fact was a false positive. Also, added note, I
do know that the source IP was not spoofed. Thanks for the help in advance.
Brian J. Bartholomew
U.S. Dept of State, Bureau of Diplomatic Security
Computer Incident Response Team
(202)663-2304
