Xmas Tree Scan Detection with Snort Description: In a Xmas tree scan, if a RST packet is received, ... - Operate on transport and network layers of the TCP/IP stack ... (flags: SFAPR; msg: 'Xmas tree scan') Using both parts together gives snort gr