NAV - WTF is this all about???????????????
NAV - WTF is this all about???????????????
Author
Discussion

marcos maniac

Original Poster:

3,148 posts

285 months

Thursday 27th May 2004
quotequote all

Left my PC on last night, woke up this morning to several NAV alerts!

Looking through them it appears that they nearly all relate to the same IP Address at approx 30 minute intervals

NAV is telling me:

Invalid TCP Destination Port
65.95.122.41

WTF?

What is this all about?

SoftwareSorcerer

437 posts

273 months

Thursday 27th May 2004
quotequote all
From Norton's site...

Invalid TCP Destination Port
Severity: Low

This attack poses a minor threat. Corrective action may not be possible or is not required.

Attack Category: Suspicious Activity

Anomalous network conditions or traffic patterns. A suspicious activity signature, for example, might detect two systems with identical IP addresses, a condition that indicates an attempted IP spoofing attack.

Description

This attack signature detects packets with a TCP destination port of 0. 0 is an invalid value for the TCP destination port and must not be used.

Hackers sometime send TCP packets with a destination port of 0 as a means of fingerprinting/profiling your operating system.

False Positive

None.