TCP SYN with flag FIN enable

[Daniel Caçador]

How I block package TCP SYN with Flag FIN enable?

Tanks

[rick jones]

Probably via ipfilter, but given that "Christmas tree" TCP segements are legal TCP segments, if perhaps as rare as hen's teeth, why are you wanting to block a SYN with the FIN set?

[Daniel Caçador]

Please tell me: You it would block? Because?

Tanks!

[Steven E. Protter]

Daniel,

Can you provide a more detailed description of why you wish to do this?

OS Version,

netstat or log output. Tell me why this needs to be done. There may be other solutions.

SEP

[Daniel Caçador]

I need to know if he has risk in not blocking the packages SYN and FIN. I need to block? Exists some form of port scanner where these packages can harm me? Well, I am using HP-UX 11i. Somebody have some manual of the TCP/IP? Perhaps either ignorance mine. Very obliged!

[Robert Fritz]

take a look at the "flags" keyword in ipfilter. That said, I'm not sure why you're singling out these. vs. the other possible "christmas tree" TCP packets.

Reference page:
http://docs.hp.com/en/B9901-90014/ch02s03.html

[rick jones]

I am not personally aware of any security risks to the HP-UX TCP stack in letting it process TCP segments with both the SYN and FIN bits set in the header.

That said, if you still wish to block such traffic you are free to do so and I suspect ipfilter is the way to do it. Ipfilter manuals should be online at docs.hp.com.

[Daniel Caçador]

After all aid and some research... I am understanding and already I know that it is not interesting to block these packages beyond the risks being few.

Very obliged to all.