Operator On The Wire
Waitlist
← Back to Knowledge Base
BLUE TEAM / SOC / FILTERING / ATTACKS / TRANSPORT LAYER / SCANNING

SYN Scanning

Hunting

Statistics → Conversations → IPv4
Statistics → Endpoints → IPv4
Statistics → Protocol Hierarchy
Statistics → IO Graph

Goal

  • Attacker sends SYN
  • If open → receives SYN-ACK
  • Sends RST (does NOT send ACK)
  • If closed → receives RST

Filters

# Excessive SYN attempts
tcp.flags.syn == 1 && tcp.flags.ack == 0

# Detect SYN-ACK followed by RST (classic half open)
tcp.flags.syn == 1 && tcp.flags.ack == 1

# Confirm port sweep
tcp.flags.syn == 1 && tcp.flags.ack == 0