Re: valid INPUT/OUTPUT rule piece?--> '-p tcp --tcp-flags ACK, FIN FIN -j DROP', etc.

[Jason Opperisano <opie@817west.com>]

On Mon, Jan 31, 2005 at 12:42:17PM -0800, seberino@spawar.navy.mil wrote:
> Thanks for your 2 links.  I really did read both of them carefully.
> They explained SYN, ACK and FIN but not URG, PSH and RST.
> Do you have another great link to explain these last 3 flags? :)

yeah--they're all within "The TCP/IP Guide" which I linked to;
specifically:

PSH:
http://www.tcpipguide.com/free/t_TCPImmediateDataTransferPushFunction.htm

URG:
http://www.tcpipguide.com/free/t_TCPPriorityDataTransferUrgentFunction.htm

RST:
http://www.tcpipguide.com/free/t_TCPConnectionManagementandProblemHandlingtheConnec.htm

you can also read some/all of RFC 793--TRANSMISSION CONTROL PROTOCOL:

http://www.faqs.org/rfcs/rfc793.html

specifically--the section on page 35 titled "Reset Generation" explains
all three states that would lead to the generation of a RST packet, and
all three specify the calculation of an acknowledgment number, whether
the packet that leads to the state had the ACK bit set or not.

this plus observation of real OS's in the real world sending real RST
packets leads me to believe that a real RST packet should have the ACK
bit set.  note; however, that more often than not--i have been proven
to be wrong on these types of things--so take what i say with a grain
of salt.

-j

--
"When will I learn? The answer to life's problems aren't at the bottom
 of a bottle, they're on TV!"
        --The Simpsons