TCP SYN FIN

TCP SYN FIN

[Steve Comfort]

Hi All,

I'm running Nessus to check my firewall rules, and its telling me :

"remote host does not drop TCP SYN packets with the FIN flag set .... "

I've tried adding the following rule :

$ipt -A INPUT -i $iface -d $network -p tcp --tcp-flags SYN,FIN SYN, FIN 
-j DROP

and a few permutations, but the warning still appears.

How do I fix this?

Best regards
Steve

Re: TCP SYN FIN

[Antony Stone]

On Friday 02 July 2004 1:27 pm, Steve Comfort wrote:

> Hi All,
>
> I'm running Nessus to check my firewall rules, and its telling me :
>
> "remote host does not drop TCP SYN packets with the FIN flag set .... "
>
> I've tried adding the following rule :
>
> $ipt -A INPUT -i $iface -d $network -p tcp --tcp-flags SYN,FIN SYN, FIN
> -j DROP

What does the variable $network corresopond to in the above rule?

Does the address you are sending the SYN-FIN packets to fall within this 
range?

If you do a "iptables -L INPUT -nvx" do the packet & byte counters show any 
packets matching the above rule?

Regards,

Antony.

-- 
Success is a lousy teacher.  It seduces smart people into thinking they can't 
lose.

 - William H Gates III

                                                     Please reply to the list;
                                                           please don't CC me.

RE: TCP SYN FIN

[listuser]

HiHo!

> > $ipt -A INPUT -i $iface -d $network -p tcp --tcp-flags SYN,FIN SYN, FIN
> > -j DROP

Maybe this is a no-brainer. But if you have copied the above from
a script you may fail to notice that this rule will throw an error.
The space between the second SYN, and FIN is wrong.
If the above is just a typo in this mail, than forget this reply :)

ciao
  markus

Re: TCP SYN FIN

[Listas de Discussão Linux]

does it not works correctly?


Atenciosamente,


Ralph Liebessohn

----- Original Message ----- 
From: <listuser@sally.epygi.de>
To: "netfilter" <netfilter@lists.netfilter.org>
Sent: Friday, July 02, 2004 10:29 AM
Subject: RE: TCP SYN FIN


> HiHo!
>
> > > $ipt -A INPUT -i $iface -d $network -p tcp --tcp-flags SYN,FIN SYN,
FIN
> > > -j DROP
>
> Maybe this is a no-brainer. But if you have copied the above from
> a script you may fail to notice that this rule will throw an error.
> The space between the second SYN, and FIN is wrong.
> If the above is just a typo in this mail, than forget this reply :)
>
> ciao
>   markus
>