Re: unused bit attack alert

["Mullen, Patrick" <Patrick.Mullen@GD-CS.COM>]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

>From the Snort Portscan module
(http://www.clark.net/~roesch/security.html)

spp_portscan.c:

   /* Strip off the reserved bits for the testing, but flag
      that a scan is being done.
   */
   th_flags_cleaned = th_flags & ~(R_RES1 | R_RES2);

   if(th_flags != th_flags_cleaned)
   {
      scan = sRESERVEDBITS;
   }

This means that anything with reserved bits set are
shown as a portscan.  Obviously, later down flags
are checked as normal using th_flags_cleaned and
flagged appropriately.

This code was inspired by connlogd, written by
Alec Kosky, which probably is also immune to this method.


~Patrick