Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
  1. TCP FIN packet, ACK flag is always set?

  2. In TCP tear-down phase, there are usually 4 packets: FIN/ACK, ACK, FIN/ACK, ACK. Is it possible some of these packets may not be sent by a TCP peer?

  3. When there is payload, as far as I know, flags like PSH, ACK, FIN can be set. When FIN is set, PSH and ACK is also set. Are there any other flags can be set when there is data payload?

  4. When RST is set, is ACK always set? Are there any other flags that can be set?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

the TCP Xmas attack uses URG in addition to FIN and PSH. differant operating systems react differently when recieving this kind of packet, so its used for OS fingerprinting. appearently it may cause crashes for some IP stacks.

its also worth noting that there are flood attacks based simply on setting invalid flag combinations. http://www.isi.edu/~mirkovic/bench/attacks.html

There may not be a specific answer to your question based on standards. in a glance at RFC-793, there do not appear to be any specifics about other flags in a FIN packet, other than that it must have ACK set (but not SYN), and SYN and ACK values that correspond to an established connection. if these minimum criteria are not met (or the stack determines that the flag combo is invalid), the packet will be dropped.

All standards have undefined aspects to their implementation, and TCP is definitely no exception. this is evidenced by the fact that some stacks crash for URG+FIN+PSH, others don't, and those that stay up respond differently.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.