kitty
11-12-2005, 09:00 PM
السلام عليكم... لو سمحتوا ممكن احد يترجم لي هذه القطعه؟
IP half scan attack
This alert notifies that repeated attempts to a destination computer were made, and no corresponding ACK packets were communicated.
A standard transmission control protocol (TCP) connection is established by sending a SYN packet to the destination computer. If the destination is waiting for a connection on the specified port, it responds with a SYN/ACK packet. The initial sender replies with an ACK packet, and the connection is established. If the destination computer is not waiting for a connection on the specified port, it responds with an RST packet.
Most system logs do not log completed connections until the final ACK packet is received from the source. Sending an RST packet instead of the final ACK results in the connection never actually being established and, therefore, the connection is not logged. Because the source can identify whether the destination sent a SYN/ACK or RST packet, an attacker can determine exactly which ports are open for connections, without the destination being aware of the probing.
If this alert occurs, log the address from which the scan occurs. If appropriate, configure the ISA Server policy rules or Internet Protocol (IP) packet filters to block traffic from the source of the scans.
جزاكم الله خيرا
IP half scan attack
This alert notifies that repeated attempts to a destination computer were made, and no corresponding ACK packets were communicated.
A standard transmission control protocol (TCP) connection is established by sending a SYN packet to the destination computer. If the destination is waiting for a connection on the specified port, it responds with a SYN/ACK packet. The initial sender replies with an ACK packet, and the connection is established. If the destination computer is not waiting for a connection on the specified port, it responds with an RST packet.
Most system logs do not log completed connections until the final ACK packet is received from the source. Sending an RST packet instead of the final ACK results in the connection never actually being established and, therefore, the connection is not logged. Because the source can identify whether the destination sent a SYN/ACK or RST packet, an attacker can determine exactly which ports are open for connections, without the destination being aware of the probing.
If this alert occurs, log the address from which the scan occurs. If appropriate, configure the ISA Server policy rules or Internet Protocol (IP) packet filters to block traffic from the source of the scans.
جزاكم الله خيرا