TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
The RealSecure Nmap decode is designed to detect the OS fingerprinting
arguement of Nmap (-O). From what I know of Nmap, it sends packets with
certain TCP flag combinations to see how the TCP/IP stack on the target box
reacts to it, thus establishing the fingerprinting of the operating system.
It is possible for this to false positive, I've seen it false positive on
gnutella traffic (usually involves port 6346).
Cheers,
Brian Fitch, IDS Named Accounts Engineer
Internet Security Systems, Inc.
-----Original Message-----
From: Bartholomew, Brian J [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 21, 2001 12:40 PM
To: '[EMAIL PROTECTED]'
Subject: NMAP Alert
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I have recently been investigating a case where ISS has thrown the NMAP
alert across when I know there was no NMAP scan. From the packets I have
captured, there doesn't appear to be any anomalous traffic to correlate with
this event. Has anyone else seen a "false positive" for this alert? To
ISS...Can you tell me exactly what triggers the alert, whether it is the
weird flag combos or something to do with the sequence numbers. I need to
be able to show that this in fact was a false positive. Also, added note, I
do know that the source IP was not spoofed. Thanks for the help in advance.
Brian J. Bartholomew
U.S. Dept of State, Bureau of Diplomatic Security
Computer Incident Response Team
(202)663-2304
