Date: Sun, 9 Mar 2003 17:26:37 -0800 From: "Crist J. Clark" <crist.clark@attbi.com> To: Sean Chittenden <sean@chittenden.org> Cc: freebsd-ipfw@freebsd.org Subject: Re: ACK+RST useful? Message-ID: <20030310012637.GB88267@blossom.cjclark.org> In-Reply-To: <20030303045138.GQ79234@perrin.int.nxad.com> References: <20030303045138.GQ79234@perrin.int.nxad.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Mar 02, 2003 at 08:51:38PM -0800, Sean Chittenden wrote:
> I'm confused as to what the point of having a packet with the RST and
> ACK flags set. In legitimate use, an RST+ACK packet is only sent
> after the connection has been closed.
Nope, you are missing the most obvious circumstances that give rise to
RST|ACK, a SYN-only packet sent to a closed port.
A RST|ACK packet is sent whenever the the RST segment is a response to
a segment that had no ACK field.
> With stateful firewalls, this
> can cause a great deal of logging of packets that are legit and apart
> of the spec, but are by and large worthless as far as I can tell.
> I've read through RFC 793 and as best as I can tell and with a
> stateful firewall, it strikes me as being _okay_ to have a drop rule
> (following the check-state rule) for packets that have the RST+ACK
> bits set. Am I wrong or missing something with this assertion? -sc
Probably not a good idea. When you try to open a connection to a close
port, rather than immediately fail when the RST is received, you'll
need to wait for the timeout.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030310012637.GB88267>