Re: DROP Fin Scan

[Blizzards <blizzards@libero.it>]

The idea behind the FIN scan, is not based on a NEW connection  (only 
pachet with the SYN bit set and ACK,RST,FIN cleared can initiate a new 
connection), but in sending an RST/FIN to a server to probe ports.
Closed ports reply to this CLEAR CONNECT FIN bit set packet with a RST 
bit set, while open port must ignore
the packet (this works on a unix TCP/IP stack).
FIN bits is sended by the client to server
server reply with ack
client close connect and reply with ack
server now send FIN and close connection
client receive final FIN and close all.
RST bit set produce an immediate closing of connection on both side.
In my opinion the 1st rule is exact:

iptables -A INPUT -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP

Bye.
G.




>: 
>
>Hi, 
>I'd like to block all FIN SCAN type. In Internet I find the following method: 
>
>iptables -A INPUT -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP 
>
>but for me is better to write: 
>
>iptables -A FORWARD -m state -state NEW -p tcp --tcp-flags FIN FIN -j DROP 
>
>that means blocking all packets with flag FIN active regarding only packets 
>belonging to new TCP connections. 
>Are you agree? 
>Thanks in advance, 
>Davide
>  
>