Well, in the three-way handshake the flags in the packets are:
1) syn packet sent by the client
2) syn,ack sent by the server
3) ack sent by the client
The packets in the NEW state for a statefull firewall (as iptables) are
packets that belongs to a new "data stream", marked with the syn flag.
The packets in the INVALID state are packets, in your case specifically,
that implies a new "data stream" (or more properly, packets that does not
belongs to a connection previously ESTABLISHED or to a connection RELATED to
a connection previously ESTABLISHED) but this new "data stream" is not
negotiating for open a new socket, is just sending "data".
To extend the analogy of the three-way handshake, someone is trying to shake
your hand but you see the persone until you have the sense of the other hand
in your hand, then you are surprised, retire your hand and face the other
person trying to recognize who is, does not shake his hand and does not
speak to him.
In fact, there are 0 packets with the state NEW with the flags
FIN,SYN,RST,ACK/SYN,ACK because the packets that you sent does not have the
right flags to be considered a valid packets to open a new connection.
Jorge.
On Sat, 4 Aug 2007 21:21:09 +0200
Franck Joncourt <franck.joncourt@xxxxxxxxxx> wrote:
Hi,
Looking at this :
http://iptables-tutorial.frozentux.net/iptables-tutorial.html#SYNACKANDNEW
I understand that in order to prevent my ip address from being spoofed,
I should reject NEW packets with the SYN/ACK flags set and the others
cleared.
However, with the following nmap command I have tried to check it out :
nmap --scanflags SYNACK 192.168.0.1
all packets are known to be in the INVALID state rather than in the NEW
state.
state NEW tcp flags:FIN,SYN,RST,ACK/SYN,ACK -> 0 packet
state INVALID tcp flags:FIN,SYN,RST,ACK/SYN,ACK -> 170 packets
They talk about sequence number, as well, in the document, but I can't
figure out what difference it makes.
Did I miss anything ?
--
Franck Joncourt
http://www.debian.org - http://smhteam.info/wiki/
GPG server : pgpkeys.mit.edu
Fingerprint : C10E D1D0 EF70 0A2A CACF 9A3C C490 534E 75C0 89FE
Jorge Isaac Davila Lopez
Nicaragua Open Source
+505 430 5462
davila@xxxxxxxxxxxxxxxxxxxxxxx
