[Bro] A strange connection

[Po-Ching Lin]

Dear Balasubramania,

        The history field is ShADAdfF, so I think it is a normal connection. SF just means
normal establishment and termination.

Po-Ching

On 2015/1/25 10:40 PM, Balasubramaniam Natarajan wrote:
>
>
> On Sun, Jan 25, 2015 at 6:12 PM, Po-Ching Lin <pachinko.tw at gmail.com <mailto:pachinko.tw at gmail.com>> wrote:
>
>
>     1419498119.991707       CLQP0QdahFaFha0U2       140.x.x.x 58967 66.171.248.x  80      tcp   http     253.220343 114502461 592490922 *SF*     T       114502154
>     ShADadfF 5       519     6    578     (empty)
>
>     Po-Ching
>
>
> Is this by any chance a SF scan ?  If this were a normal connection won't we be seeing an Ack Flag, Push Flag in addition to the SF noted above ?
>
> -- 
> Regards,
> Balasubramaniam Natarajan
> http://blog.etutorshop.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150125/129cfb56/attachment.html