['flow']
src_ip: 172.16.0.1, src_port: 40344, dest_ip: 192.168.10.50, dest_port: 1287, event_type: flow, proto: TCP, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 74, flow_bytes_toclient: 60, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 16, tcp_tcp_flags_ts: 02, tcp_tcp_flags_tc: 14, tcp_syn: True, tcp_rst: True, tcp_ack: True, tcp_state: closed
The network event indicates a Portscan. Portscans involve scanning multiple ports on a target machine to identify open ports and services. Typically, the logs show multiple short-lived connection attempts from the same source IP to different destination ports. These connections are characterized by SYN, RST, and ACK flags, minimal data exchange, and immediate termination, often due to timeouts. This pattern of behavior is consistent with port scanning activity where the objective is to probe the target machine for open ports without establishing full connections.
classification: Attack
justification: The network event indicates a Portscan. Portscans involve scanning multiple ports on a target machine to identify open ports and services. Typically, the logs show multiple short-lived connection attempts from the same source IP to different destination ports. These connections are characterized by SYN, RST, and ACK flags, minimal data exchange, and immediate termination, often due to timeouts. This pattern of behavior is consistent with port scanning activity where the objective is to probe the target machine for open ports without establishing full connections.