Enterasys Intrusion Prevention System Manual page 247

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
TCP_ECM
7.0 XML Attribute
NSC/SC/C/ActiveResponse/tcp-ecm
Description
For the [TCP-FLAGS] event which occurs for
TCP flag combinations specified by
NSC/SC/C/TransportLayer/Flags
dragon.net file, the Network Sensor can emit
random packets which confuse network
scanners using the TCP protocol. Traditional
network scanners either used Syn packets or full
TCP connections to establish which TCP
services were available on a target host. Syn-
Ack packets from specific ports or actual banner
messages, such as Sendmail 8.8.9, indicated the
presence of various services.
Several new techniques to detect these Syn and
port scans emerged. In response, hackers
developed new techniques to determine open
ports and operating system type. By tweaking
certain combinations of the various TCP flags
(there are about 128 combinations) and
maintaining a database of how target systems
respond to various probes, hackers developed
methods to determine the type of OS with only
two or three TCP packets. They also figured out
methods to determine open ports without
sending Syn packets.
All of these techniques rely on the use of several
different TCP flag combinations. Typically, these
are the null packet (all flags turned off), the
Christmas Tree packet (all flags turned on), the
Syn-Fin packet (Syn and Fin bits set) and
sometimes the Fin-Urg-Push packet (the Fin bit,
the Urgent bit and the Push bits all set). TCP
based scanners keep state on these particular
packets and expect unique responses based on
OS type and if the targeted port is open or
closed. For example, a scanner targeting a web
server may send a Fin-Syn packet to port 80 and
receive an Ack-Rest packet, but when sending
the same packets to other ports, may receive an
Ack packet. The discrepancy is enough for the
scanner to automatically assume that port 80 is
an active port.
With the TCP_ECM setting, the Network Sensor
can spoof several responses to these highly
specific probes. The responses will contain
random TCP flag combinations. The random
combinations defeat the automatic lookup of the
expected response from the scanned server. The
real response from the scanned server is still
sent to the scanning computer, but most
automatic scanners believe the first packets
received from the scan.
Creating Network Sensor Policies and Signatures A-53
6.x to 7.x Mappings
in the