Pseries Installation Guide

P-Series Installation and Operation Guide, version 2.3.1.2 73
Anomalous TCP Flags
Some TCP packets with anomalous flags are captured by default to provide scan detection software
diagnosis information. Table 24 shows rules which were derived from the Snort scan pre-processor.
The compiler also automatically produces rules that match all packets that are IP fragments or have IP
options. These rules are not specified in the pnic.meta file as they can be more efficiently implemented by
the compiler directly.
Table 24 TCP Packets with Anomalous Flags
alert on c0 tcp any any -> any any (msg:"Z SAPU TCP Flags"; flags:SAPU;)
alert on c0 tcp any any -> any any (msg:"Z FU TCP Flags"; flags:FU;)
alert on c0 tcp any any -> any any (msg:"Z PF TCP Flags"; flags:PF;)
alert on c0 tcp any any -> any any (msg:"Z UP TCP Flags"; flags:UP;)
alert on c0 tcp any any -> any any (msg:"Z Zero TCP Flags"; flags:0;)