Results 1 to 9 of 9

Thread: Norton IDS

  1. February 26th, 2003, 04:06 PM #1
    Penguin
    Penguin is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    144

    Norton IDS

    Details: Intrusion: Invalid IP Flags
    Intruder: 80.14.236.194
    Risk Level: Low
    Source IP address: 80.14.236.194
    Destination IP address: michael(203.125.127.251)
    Protocol: TCP.
    IP Flags and Fragment Offset: 0x00009813. This field is invalid.

    Click on the address to trace the attacker
    You can get detailed information about this attack at Symantec Security Response

    what is Invalid IP Flags?what is the threat?
    BlAcKiE
    GearBlitz
    Reply With Quote Reply With Quote
  2. February 26th, 2003, 04:09 PM #2
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    Well, we can't really tell without the rest of the stream/datagram since those field are relative to the other packets...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
  3. February 26th, 2003, 05:18 PM #3
    Penguin
    Penguin is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    Originally posted here by ammo
    Well, we can't really tell without the rest of the stream/datagram since those field are relative to the other packets...

    Ammo
    what could be the threat?how can this Invalid IP help in penetrating my PC?
    BlAcKiE
    GearBlitz
    Reply With Quote Reply With Quote
  4. February 26th, 2003, 05:40 PM #4
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    Hum, on second look, I'm not sure what they mean with
    "IP Flags and Fragment Offset: 0x00009813"...
    Do they offer any details somewhere in th doc/help?

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
  5. February 27th, 2003, 02:16 AM #5
    Penguin
    Penguin is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    Originally posted here by ammo
    Hum, on second look, I'm not sure what they mean with
    "IP Flags and Fragment Offset: 0x00009813"...
    Do they offer any details somewhere in th doc/help?

    Ammo
    then i think norton didnt log it very well...
    BlAcKiE
    GearBlitz
    Reply With Quote Reply With Quote
  6. February 27th, 2003, 02:41 AM #6
    don
    don is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    110
    Normally invalid ip flags are an illegal combination of tcp flags which are set in the 13th byte
    of the tcp header. The first two bits of the byte used to reserved but are now used for congestion management. The other 6 bits are used for your flags ie: syn/fin/ack/rst/psh/urg For example if you send a packet with the syn and fin flags set that would be an invalid flag combination.
    Reply With Quote Reply With Quote
  7. February 27th, 2003, 05:07 PM #7
    Penguin
    Penguin is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    is it a critical attack?
    BlAcKiE
    GearBlitz
    Reply With Quote Reply With Quote
  8. February 27th, 2003, 06:25 PM #8
    don
    don is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    110
    Nah this is an old hack. Any ids system worth it's salt ie: Blackice amongst others will pick this
    up all the time. Only of concern if you were running services on an unprotected box.
    Reply With Quote Reply With Quote
  9. February 28th, 2003, 02:34 PM #9
    Penguin
    Penguin is offline
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    Originally posted here by don
    Nah this is an old hack. Any ids system worth it's salt ie: Blackice amongst others will pick this
    up all the time. Only of concern if you were running services on an unprotected box.
    i wish to understand how it can compromise my system?what kind of service the unprotected box must be running?
    BlAcKiE
    GearBlitz
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules