Timeline for Is the TCP ACK bit set for things like HTTP responses?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2015 at 16:05 | comment | added | OzNetNerd | "The firewall will only work at the TCP layer anyway, so you can forget HTTP, completely." Just to clarify, I'd say the majority of today's firewalls can filter at layer 7 (e.g HTTP). Filtering based on port numbers is a thing of the past and is not very useful at all given that users are able to run a lot of applications on any ports they like. For example, torrenting on port 80. NGFWs can tell the difference between Web and torrent traffic and block the torrent traffic accordingly. | |
| Nov 18, 2015 at 20:16 | comment | added | Zen Hacker | But the problem is the ACK flag is only set on TCP acknowledgement packets, which do not carry any useful information as far as the end user is concerned, so if you only allow packets that have that flag set, you will drop all useful packets. Am I right in thinking this? I can see your logic in blocking out SYN only packets and letting everything else in though. That makes a lot more sense. Unless each HTTP request/response occupies its own TCP session, in which case only the SYN flag would be set for an HTTP response, and it would be blocked. I don't really understand how this works. | |
| Nov 17, 2015 at 22:07 | history | answered | Xavier Nicollet | CC BY-SA 3.0 |