TCP Host Sweeps are types of scans that
are detected when a single host is searching for a single running
service on multiple hosts—the victims. Common scans use normal TCP-SYN
(connection request) to determine that a service is running. Stealth
scans use FIN, SYN-FIN, null, or PUSH flags and fragmented packets to
determine that a service is running. The following are different TCP
Flags:
- SYN—Synchronize sequence
numbers to initiate a connection. Each time a new connection is
established the SYN flag is turned on.
- FIN—When set, this flag implies
that the sender has finished sending data.
- ACK—When the ACK field is on,
the acknowledgment number in the corresponding field is valid. The
acknowledgment number contains the next sequence number that the
sender of the acknowledgment expects to receive.
- RST—-This flag is used to reset
the TCP connection.
- URG—The urgent pointer is valid
when this flag is set. This pointer is a positive offset that must
be added to the sequence number field of the segment to yield the
sequence number of the last byte of urgent data.
- PSH—Indicates that the receiver
should pass this data to the application as soon as possible.
|
|
