ra output intrepretation
r.fulton at auckland.ac.nz
Thu Jun 24 17:05:03 EDT 1999
Thanks for your comprehensive answer to my query.
I think that the first packet to port 80 may have had fin flag set thus
is label EST by ra in detail mode (that is really what I wanted to
know) and I had forgotten that it would go right through the filter
which does only block syn packets. This is, of course, the main purpose
of using fin scans.
I have a slightly modified version of ra that I use for detecting
scans, I will add some logic to it to report connections consisting of
lone fin or fin and rst.
More information about the argus