TCP packet with Win=0

[Bruno MMSC]

Hi,

I'm having an application on HP-UX 11.0.
On this i have an HTTP client application.
Some times with tcpdump i see a TCP packet with HTTP data and Win=0. This connection is sistematically reset from the HTTP server, by reset i mean a TCP reset flag set in answer from the server.
Any idea on how to solve this?

[harry d brown jr]

Bruno,

The first step is to make sure you have the latest patches.

Go to "maintenance and support"
then under "Patching"
take "customized patch bundles (custom patch manager)"

live free or die
harry

[Bruno MMSC]

Thanks,

i cannot install patches without control on the machine. It is in a production environment.
Apllication SW installed on the machine is strongly dependent on the patch level.
Any other more detailed suggestion?

Bruno

[Ron Kinner]

Would be easier if you would give the exact packet info but there is a hacker technique called hping which uses win=0 and the reset flag.

http://www.securiteam.com/securitynews/A_new_stealth_port_scanning_method.html

The technique sends a packet from A to C with the source faked to appear that it comes from B. C replies to B with RST since it knows nothing of an existing conversation with B. This method is used to scan for open ports on C.



Ron