The traffic patterns you should look for are:
- ACK scanning: Multiple ACKs are sent usually to multiple ports in order to break the existing TCP connections
Figure 19.15: TCP ACK scanning
- Unusual flag combinations: This refers to anything with a URG flag, FIN and RST, SYN-FIN, and so on. Unusual flag combinations are not the usual SYN, FIN or RST, with or without ACK. In the following screenshot, you see an example of this scenario. The operations FIN/PSH/URG are together called Xmas scan.
Figure 19.16: TCP unusual flag combinations ...
