Operator On The Wire
← Back to Knowledge Base
BLUE TEAM / SOC / FILTERING / ATTACKS / TRANSPORT LAYER / SCANNING

Scanning Matrix

Scan TypeCore Flag PatternKey Confirmation
SYNSYN onlySYN-ACK → RST
NULLNo flagsRST from closed ports
ACKACK onlyRST flood
FINFIN onlyRST on closed
XMASFIN+PSH+URGRST on closed

Detection

  1. Identify abnormal flag pattern
  2. Pivot by source IP
  3. Confirm multi-port targeting
  4. Confirm short time interval
  5. Observe RST burst responses