Hunting

Statistics → Conversations → IPv4
Statistics → Endpoints → IPv4
Statistics → Protocol Hierarchy
Statistics → IO Graph

Goal

Used to map firewall rules.

Attacker sends ACK packets without handshake. Response:

• If filtered → no response
• If unfiltered → RST

Important: ACK scan does NOT detect open ports reliably.

Filters

# ACK without SYN
tcp.flags.ack == 1 && tcp.flags.syn == 0

# Excessive ACKs from single source
tcp.flags.ack == 1 && tcp.flags.syn == 0

# RST flood
tcp.flags.reset == 1