|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] Syn for established connection
Jim Parker wrote: > > Hi everyone ! Just want to know does anyone encounter a "SYN packet for established connection" error in NG fp2? actually i read an article by David Grabowski- about what he learned in FW-1 state table..that an established TCP session will by default have a lifetime of 3600 sec. and every packet traverse will reset the timer..After the session will closed (via FIN or RSt packet) it enters a "half-closed" state..the lifetime is 50 sec. the problem is the Device im using uses a statically coded source port for its communication and there is no way we can reconfigure this. if a new syn connection is attemted and matches the established connection it is dropped by the FW-1. In version FW-1 4.1 this syn packet will be match against the rulebase..does anyone knows how to revert the behavior of NG to 4.1 on how it handles a syn connection or a workaround. [Could you please wrap your lines at about 72 columns or so?] Actually, this state that the firewall enters after the connections are closed up sounds more analogous to the TIME_WAIT state. Contrary to many TCP/IP newbies' beliefs, TIME_WAIT is a Good Thing. I would expect you to have this problem whether or not there is a firewall in between your (broken) client with the fixed source port and the server. I guess it's not so odd, since the client (which looks broken already) is typically the one who ends up in TIME_WAIT. However, I am not sure what additional security enforcing something like TIME_WAIT at the firewall is supposed to add. -- Crist J. Clark [email protected] Globalstar CommunicationsThe information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact [email protected] ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
