Re: TCP SYN packets which have the FIN flag set.
On Thu, 2004-11-04 at 17:48, Luis Pérez Meliá wrote:
> I'm using iptables.
>
> In my rules I have this:
> .
> .
> .
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL SYN -j ACCEPT
Please dont do that!
You are not only blocking illegal flag combinations, you are also
blocking perfectly legal ones! And then spreading this bad
configuration.
There are flags in the TCP that we want to be allowed on start of
connections, specifically ECN flags, you can look at
http://www.icir.org/floyd/ecnProblems.html
Note that you will not be able to receive mails from the LKML with such
a setup since LKML server uses ECN.
You can use SYN,ACK,FIN,RST SYN to check for illegal flags.
Baruch
Reply to: