# SYN/ACK Attack
**URL:** https://community.zeek.org/t/syn-ack-attack/4260
**Category:** Zeek
**Created:** [July 24, 2016, 3:01pm UTC](https://community.zeek.org/t/syn-ack-attack/4260 "2016-07-24T15:01:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)
#### Post date: [July 24, 2016, 3:01pm UTC](https://community.zeek.org/t/syn-ack-attack/4260/1 "2016-07-24T15:01:37Z")
Bro Community
I have been seeing A LOT of SYN/ACK attacks lately on my net and it seems that every time Bro is switching the orig and resp IP’s. Luckily the history column has helped me determine which IP is the true src.
Also, I have SiLK running on my bro sensors and the netflow traffic I get from SiLK is identifying the true src and resp IP addresses but Bro seems to switch the IP addresses. Is this because Bro thinks it missed the SYN packet so it switches the IP’s? Should it be doing this?
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [July 25, 2016, 3:18pm UTC](https://community.zeek.org/t/syn-ack-attack/4260/2 "2016-07-25T15:18:16Z")
Bro has a few heuristics when to flip the endpoints. The main one is
that when it misses the initial SYN but the SYN/ACK is coming \*from\* a
well-known server port, it assumes it's seeing a responder-side
packet. This table determines what Bro considers a server port:
[https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#id-likely\_server\_ports](https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#id-likely_server_ports)
To help spot cases where the direction got slipped, master recently
got a feature that now adds a '^' flag to the connection history in
these cases.
Robin
---
### Author:  [@Jan](https://community.zeek.org/u/Jan)
#### Post date: [July 25, 2016, 7:06pm UTC](https://community.zeek.org/t/syn-ack-attack/4260/3 "2016-07-25T19:06:34Z")
Since originator/responder depends on the protocol logic, another
solution would be to log the source address of the first packet of the
connection. I've just written a small script
([https://gist.github.com/J-Gras/f6bfb6092d29aa0e9c53eb98e23a7955](https://gist.github.com/J-Gras/f6bfb6092d29aa0e9c53eb98e23a7955)) that
should achieve this. As it uses the new bif
"get\_current\_packet\_header()", the script only works with master (see
[http://try.bro.org/#/trybro/saved/80298](http://try.bro.org/#/trybro/saved/80298)).
Best regards,
Jan
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/syn-ack-attack/4260/4 "2022-05-06T15:43:52Z")