10

In TCP header, what happens when both SYN and FIN flags are set to 1? Or, can both even be simultaneously set to 1 ?

  • An irish revolution? – bmargulies Oct 18 '14 at 1:46
  • Hmmm I noticed on my campus network today that since the new iPhones have come out, we are getting a flood of tcp packets that have both syn and fin flagged. Our system is having trouble identifying the phone/os other than "iPhone IOS" without a version number. Maybe the new update or the new phone is doing something odd. – user10003 Oct 22 '14 at 14:04
  • @ThomasNg wow .. give updates on what your campus network administrator does to handle these illegal packets. – MAKZ Oct 22 '14 at 16:46
11

In normal TCP behavior, they should never both be set to 1 (on) in the same packet. There are many tools that exist that let you craft TCP packets, and the typical response to a packet with SYN and FIN bits set to one is a RST, since you are violating the rules of TCP.

9

One type of attack in the olden days was to have every Flags set to 1. That was:

  • Nonce
  • CWR
  • ECN-ECHO
  • URGENT
  • ACK
  • Push
  • RST
  • SYN
  • FIN

A few implementation of IP stacks didn't check correctly and crashed. It was called a Christmas Tree Packet

  • While this is interesting information, it really just barely touches on an answer to "can both be set to 1" by providing an example. – YLearn Oct 22 '14 at 15:36
  • It was more intended as a comment to the previous answer, but as comments are pretty limited format-wise, I thought it was better to do a separate answer – Remi Letourneau Oct 22 '14 at 17:10
3

The response depends on the type of Operating System.

The combination of SYN and FIN flag being set in TCP header is illegal and it belongs to the category of illegal/abnormal flag combination because it calls for both establishment of connection(via SYN) and termination of connection(via FIN).

The method to handle such illegal/abnormal flag combinations is not conveyed in the RFC of TCP. So, such illegal/abnormal flag combinations are handled differently in various operating systems. Different operating system also generate different kind of responses for such packets.

This is a very big concern for security community because attackers shall exploit these response packets to determine the type of OS on the target system to craft his attack. So, such flag combinations are always treated as malicious and modern intrusion detection systems detect such combinations to avoid attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.