Hunting

Statistics → Conversations → IPv4
Statistics → Endpoints → IPv4
Statistics → Protocol Hierarchy
Statistics → IO Graph

Goal

Flags set:

• FIN
• PSH
• URG Classic “lit up like a Christmas tree”.
• Open → no response
• Closed → RST

Filters

# Detect XMAS
tcp.flags.fin == 1 &&
tcp.flags.push == 1 &&
tcp.flags.urg == 1