Packet Tuesday - TCP Urgent Flag

In this episode of Packet Tuesday we analyze TCP Urgent Flag.
Each Tuesday Dr. Johannes Ullrich will cover a specific network feature by analyzing a packet to help you better understand networks and network traffic.
Notes:
SEC503 Network Monitoring and Threat Detection In-Depth: www.sans.org/u...
RFCs:
datatracker.ie... TCP Original
datatracker.ie... TCP Updated
datatracker.ie... Official Internet Protocols
datatracker.ie... On the Implementation of
the TCP Urgent Mechanism
pcap:
packettuesday....

[@linuxviking]

What an excellent example!

[@jaredross7990]

AMAZING video. This was exactly what I was looking for. Absolutely fascinating. I had no choice but to instantly subscribe. Thank you!

[@stealth_mode44]

Thanks for this informative session. Appreciated! It would be interesting to learn more in depth on ICMP and DNS :)

[@sansinternetstormcenter6858]

There will certainly be more DNS. As for ICMP: I am actually looking at an interesting vulnerability right now... so if I have more about that, I may do some ICMP soon.

[@fredtheilig9636]

I'd be curious to learn more about Arkime/Moloch.

[@sansinternetstormcenter6858]

A bit beyond the scope of these, but let me see if I can put something together.

[@davesabra4320]

All the UPS flagging looks like a way to fill special buffers with spam characters, for some reason, from the Alibaba Advertising company. What are they doing?