> Can't these kind of packets get handled by an INVALID match, with one > rule per appropriate chain? But having a FIN segment without the ACK set is *unusual* but not INVALID. The answer to your question depends on what is considered INVALID. I'm still not sure where to learn this level of detail to understand what flag combos are invalid or unusual. Chris
