There is a known bug that causes certain (all?) SonicWalls to false positive on FIN scans. It has to do with http keep-alives I believe. I've learned to just ignore "probable FIN scans" against port 80. Pretty lame but there it is.
Jim Grossl Systems Admin Lee Pesky Learning Center Boise, Idaho USA -----Original Message----- From: David McRell [mailto:[EMAIL PROTECTED]] Sent: Thursday, July 25, 2002 1:16 PM To: SonicWall List Subject: Re: [SonicWALL]- TCP FIN Scan On that note, I keep getting 'Probable TCP Fin scan' from PORT 80 to high ports on my public NAT IP. Does anyone else experience this pattern? On 7/22/02 7:20 AM, "Eric Johnson" <[EMAIL PROTECTED]> wrote: > When my users check their e-mail I get a warning from the sonic wall (pro > 100) saying a possible fin scan was detected. The mail server is iMail > 6.05. Is there something that I am doing wrong or is this just odd > interaction between the sonic wall and iMail? -- David McRell, CTO, Danetracks, Inc. 7356 Santa Monica Blvd. West Hollywood, CA 90046 Tel 323-512-8160 Fax 323-512-8163 --- [This E-mail scanned for viruses by Declude/F-Prot AV] ============================================================================ ======================= To unsubscribe, send email to [EMAIL PROTECTED] In the body of the email put the following: unsubscribe sonicwall your_name The archive of this list is at http://www.mail-archive.com/sonicwall%40peake.com/ --- [This E-mail scanned for viruses by Declude/F-Prot AV] =================================================================================================== To unsubscribe, send email to [EMAIL PROTECTED] In the body of the email put the following: unsubscribe sonicwall your_name The archive of this list is at http://www.mail-archive.com/sonicwall%40peake.com/
