ET HUNTING TCP SYN with IPv4 LSRR Source Routing Option

7.0.35.0SID: 2072641Rev: 1Disabled6 views
Sourceet/open
Fileemerging-hunting.rules
CreatedNovember 6, 2026
UpdatedNovember 6, 2026
Classificationattempted-recon
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING TCP SYN with IPv4 LSRR Source Routing Option"; reference:url,www.doxx.net/blog/network-operators-should-be-doing-this/; reference:url,www.rfc-editor.org/info/rfc7126/; classtype:attempted-recon; sid:2072641; rev:1; metadata:affected_product Linux, attack_target Linux_Unix, created_at 2026_11_06, deployment Perimeter, performance_impact Significant, confidence Medium, signature_severity Informational, updated_at 2026_11_06;)
Detection details are hidden.

References

urlwww.doxx.net/blog/network-operators-should-be-doing-this/
urlwww.rfc-editor.org/info/rfc7126/

Metadata

affected productLinux
attack targetLinux_Unix
created at2026_11_06
deploymentPerimeter
performance impactSignificant
confidenceMedium
signature severityInformational
updated at2026_11_06

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!