CODEWITHSUNDEEP
intrusion-detection
Thanh Duy Cao
Thanh Duy Cao

Reputation: 47

Is there a definition to SYN error in KDD99 dataset?

I'm studying about the KDD99 dataset. There's an error called "'SYN' error" in 25th and 26th feature of the dataset. Can anyone please tell me what type of error is it and when does it happen? Thank you very much.

Upvotes: 0

Views: 77

Answers (2)

Rameshkumar
Rameshkumar

Reputation: 260

Possible conn_state values:

S0: Connection attempt seen, no reply.

S1: Connection established, not terminated.

SF: Normal establishment and termination. Note that this is the same symbol as for state S1. You can tell the two apart because for S1 there will not be any byte counts in the summary, while for SF there will be.

REJ: Connection attempt rejected.

S2: Connection established and close attempt by originator seen (but no reply from responder).

S3: Connection established and close attempt by responder seen (but no reply from originator).

RSTO: Connection established, originator aborted (sent a RST).

RSTR: Responder sent a RST.

RSTOS0: Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder.

RSTRH: Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator.

SH: Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was “half” open).

SHR: Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator.

OTH: No SYN seen, just midstream traffic (one example of this is a “partial connection” that was not later closed).

Upvotes: 0

lazurite
lazurite

Reputation: 11

See conn_states:

https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html

SYN errors raise s0, s1, s2, s3.

Upvotes: 0

Related Questions