Hunting

Statistics → Conversations → IPv4
Statistics → Endpoints → IPv4
Statistics → Protocol Hierarchy
Statistics → IO Graph

Goal

Attacker sends FIN-only packets.

• Open → no response
• Closed → RST

Filters

# FIN only
tcp.flags.fin == 1 && 
tcp.flags.syn == 0 && 
tcp.flags.ack == 0

# Detect Port Sweep
tcp.flags.fin == 1