How to set a rule that used by snort to detect an ack scan

Assignment Help Computer Engineering

Reference no: EM132265

Question

An ACK scan does not provide in order about whether a target machine's ports are open or closed, except rather whether or not access to those ports is being blocked by a firewall. If there is no response or an ICMP "destination unreachable" packet is received as a response, then port is blocked by a firewall. If scanned port replies with a RST packet, then ACK packet reached its intended host. So end port is not being filtered by a firewall. Note, though, that port itself may be open or closed.

Describe a rule or a set of rules that might be used by Snort to detect an ACK scan. Cleary express your assumption and explain your rules. What do you think Bro can do a better job detecting an ACK scan? Describe your answer in details.

Reference no: EM132265

Questions Cloud

Explain the method to find cost of sorting the relation : Explain the method to find cost of sorting the relation In each case, how many combine passes are required?

Analytical methods commonly used in industrial hygiene : Name two analytical methods commonly used in Industrial Hygiene. Illustrate your answer with two typical examples What are the four significant physical parameters that you would use to assess the thermal comfort of employees working in a hot and..

What is the specialization of Dottie's Tax facility : What is the specialization of Dottie's Tax facility At least 6 returns? (Round z-score computation to 2 decimal places and your final answer to 4 decimal places.)

What security measures required to address vulnerabilities : What security measures required to address vulnerabilities Illustrate threats and vulnerabilities that are possible after implementing "big data" technologies in online auctioning company.

How to set a rule that used by snort to detect an ack scan : How to set a rule that used by snort to detect an ACK scan What do you think Bro can do a better job detecting an ACK scan?

How to create program that performs arithmetic function : How to create program that performs arithmetic function Prompt a user for values for the variables. Pass both variables to methods named sum() and difference().

What does ld 50 mean in industrial toxicology : What are the units commonly used in occupational exposure limits for quantifying the concentration of dust particles, vapours or gases and fibres? What does LD 50 mean in Industrial Toxicology

How to create the clients by service rep report : How to create the clients by service rep report create mailing label for client table

User Account

All Pages