[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Blocking Packets with SYN and FIN Flags Set

A TCP header with the SYN and FIN flags set is anomalous TCP behavior, causing various responses from the recipient, depending on the OS. Blocking packets with SYN and FIN flags helps prevent OS system probes.

Before You Begin
For background information, read Understanding Operating System Probes.

You can use either J-Web or the CLI configuration editor to block packets with both the SYN and FIN flags set.

This topic covers:

J-Web Configuration

To configure screens:

Select CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Screen, click Configure.
Next to Ids option, click Add new entry.
In the Name box, type syn-fin.
Next to Tcp, click Configure.
Next to Syn fin, select the check box and click OK.
To save and commit the configuration, click Commit.

To configure zones:

Select CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Zones, click Configure.
Next to Security zone, click Add new entry.
In the Name box, type zone.
In the Screen box, type syn-fin and click OK.
To save and commit the configuration, click Commit.

CLI Configuration


            
               user@host# set security screen ids-option
                     syn-fin tcp syn-fin
               user@host# set security zones security-zone
                     zone screen syn-fin

Blocking Packets with SYN and FIN Flags Set

J-Web Configuration

CLI Configuration

Related Topics