An NSM analyst is reviewing Zeek logs and sees conn.log entries wit…

Question

An NSM analyst is reviewing Zeek logs and sees conn.log entries with connstate of 'S0'. What does this connection state indicate?

Accepted Answer

A connection attempt (SYN sent) with no response — the connection was never established, typical of port scanning or unreachable hosts — Here's the deal — b is correct because Zeek's connstate 'S0' means a SYN was sent but no SYN-ACK was received (the connection attempt received no response), which is the expected result when port scanning closed or filtered ports on unreachable hosts. A is wrong because a successfully completed connection would have state 'SF' (normal establishment and close).

Answer

A connection that completed successfully with both sides sending data

Answer

A connection that was reset by the responder

Answer

A connection where the originator terminated gracefully with a FIN

An NSM analyst is reviewing Zeek logs and sees `conn.log` entries with `conn_state` of 'S0'. What does this connection state indicate?

Short Explanation and Infographic

Full Explanation

An NSM analyst is reviewing Zeek logs and sees conn.log entries with conn_state of 'S0'. What does this connection state indicate?

Short Explanation and Infographic

Full Explanation

An NSM analyst is reviewing Zeek logs and sees `conn.log` entries with `conn_state` of 'S0'. What does this connection state indicate?