Stealth FIN Scan Port Probe

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects a stealth FIN scan port probe. A FIN scan is a type of port scan that sends TCP segments with only the FIN flag set. If the target port is closed, it should respond with an RST segment. If the port is open, it should ignore the FIN segment. This rule triggers if 10 such FIN packets are observed from a single source within a 30-second window, indicating a potential port scan attempt.