Hunting

Statistics → Conversations → IPv4
Statistics → Endpoints → IPv4
Statistics → Protocol Hierarchy
Statistics → IO Graph

Goal

• Attacker sends TCP packet with NO flags set.
• Open port → no response
• Closed port → RST

Filters

# Detect no flags
tcp.flags == 0

# More explicit
tcp.flags.syn == 0 &&
tcp.flags.ack == 0 &&
tcp.flags.fin == 0 &&
tcp.flags.reset == 0 &&
tcp.flags.push == 0 &&
tcp.flags.urg == 0