Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Bad options? |
|---|---|
| Date: | Thu, 26 Aug 2004 15:00:28 -0400 |
Hello,
Has anyone had any detects similar to below? Is this a form of fingerprint
(this being a fingerprint response? Any insight into what the last TCP
option
fields may be? I have seen interesting traffic like this before, but have
not found any text that could explain it.
Any help appreciated.
09:27:21.621476 xxx.xxx.xxx.xxx.http > xxx.xxx.xxx.xxx.46045: . ack
3207692596 win 8688 <nop,nop,sackOK,[bad opt]> (DF)
4500 0034 e1a2 4000 3e06 b453 xxxx xxxx
xxxx xxxx 0050 b3dd d43c c6f2 bf31 8134
8010 21f0 980d 0000 0101 0402 4c66 7844
0278 c313
Thanks,
Dan
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [Full-Disclosure] Re: block all popups [google knockoff], sh0rtie |
|---|---|
| Next by Date: | Re: Bad options?, Jeffrey Denton |
| Previous by Thread: | compromised machines, Varun Pitale |
| Next by Thread: | Re: Bad options?, Jeffrey Denton |
| Indexes: | [Date] [Thread] [Top] [All Lists] |