Hunting

Statistics → Endpoints → IPv4 Statistics → Conversations → TCP Statistics → Protocol Hierarchy

Goal

Source IP == Destination IP
Source Port == Destination Port Host attempts connection to itself. Old-school DoS.

Red Flags

• ip.src == ip.dst
• Repeated SYN packets without handshake completion
• Source port equals destination port
• High SYN rate with no ACK follow-up

Filters

# Source equals destination
ip.src == ip.dst

# SYN only (no ACK)
tcp.flags.syn == 1 and tcp.flags.ack == 0

# Combined LAND pattern
ip.src == ip.dst and tcp.flags.syn == 1 and tcp.flags.ack == 0