TCP FIN packet, ACK flag is always set?
In TCP tear-down phase, there are usually 4 packets: FIN/ACK, ACK, FIN/ACK, ACK. Is it possible some of these packets may not be sent by a TCP peer?
When there is payload, as far as I know, flags like PSH, ACK, FIN can be set. When FIN is set, PSH and ACK is also set. Are there any other flags can be set when there is data payload?
When RST is set, is ACK always set? Are there any other flags that can be set?
the TCP Xmas attack uses URG in addition to FIN and PSH. differant operating systems react differently when recieving this kind of packet, so its used for OS fingerprinting. appearently it may cause crashes for some IP stacks.
its also worth noting that there are flood attacks based simply on setting invalid flag combinations. http://www.isi.edu/~mirkovic/bench/attacks.html
There may not be a specific answer to your question based on standards. in a glance at RFC-793, there do not appear to be any specifics about other flags in a FIN packet, other than that it must have ACK set (but not SYN), and SYN and ACK values that correspond to an established connection. if these minimum criteria are not met (or the stack determines that the flag combo is invalid), the packet will be dropped.
All standards have undefined aspects to their implementation, and TCP is definitely no exception. this is evidenced by the fact that some stacks crash for URG+FIN+PSH, others don't, and those that stay up respond differently.