On 2/13/06, Aleksander <aleksander@xxxxxxxxxxxxxxx> wrote:
> Hello list,
>
> My firewall drops packets, which state is NEW, but no SYN bit is set.
> Now I started logging these dropped packets and there are loads of them.
> All connecting to the 443 port from random IP's (legitimate clients).
> The service is https. The service works fine, but I'm still worried
> about the dropping.
>
> The rules:
> ${IPTABLES} -t filter -A bad_tcp_packets -p tcp --tcp-flags ! SYN SYN -m
> state --state NEW -j LOG --log-prefix "BAD PACKET N
> EW+!syn: "
> ${IPTABLES} -t filter -A bad_tcp_packets -p tcp --tcp-flags ! SYN SYN -m
> state --state NEW -j DROP
>
> An example, from the FORWARD chain:
> Feb 13 11:18:38 myname kernel: BAD PACKET NEW+!syn: IN=eth1 OUT=eth0
> SRC=1.2.3.4 DST=192.168.111.34 LEN=75 TOS=0x00 PREC=0x00 TTL=56 ID=47503
> DF PROTO=TCP SPT=36086 DPT=443 WINDOW=32942 RES=0x00 ACK PSH FIN URGP=0
>
> What should I think of this?
>
Many times this is because of late packets getting to your server. It
might be because the server has finished the session (it saw a FIN or
RST on its side) and so has closed down the session.. or it might be
that the client didn't get the servers RST/FIN and is sending a second
ACK/PSH/FIN to make sure the session is closed.
There are probably other reasons for this, but this has been my
biggest number. There are some probe tools that just send ACK-PSH-FIN
packets to see what they get back from firewalls.
> Thanks,
> Alex
>
>
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
