TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
This is my conclusion as well. I was disappointed to see the ISS software so easily confused. A "Connection Event" should be looking exclusively at the initiation packet (SYN) and not any old packet headed for a particular destination port. Hopefully, this is something ISS can correct? ----- Original Message ----- From: <[EMAIL PROTECTED]> Subject: RE: RE: Connection event for port ---------------------------------------------------------------------------- That's the return packet (probably a SYN-ACK) establishing the second half of the connection -- ie when a client sends a SYN to a server to open a connection, the server responds with a SYN-ACK that simultaneously acknowledges the connection request and sets up the return half of the conversation. This is why the next XPU (which will hopefully contain the signatures for this worm) is being awaited so anxiously...
