Does any one know what the different options are and mean for snort flags with the syn option. Example below:
alert external_ip any -> internal_ip 8080 (flags:S,12; msg "Possible SYN scan"
I know 12 has to do with finding a syn packets regardless of the values of the reserved bits.
Could anyone clarify this more? Also are there other options?