11

In TCP header, what happens when both SYN and FIN flags are set to 1? Or, can both even be simultaneously set to 1 ?

3
  • An irish revolution?
    – bmargulies
    Oct 18, 2014 at 1:46
  • Hmmm I noticed on my campus network today that since the new iPhones have come out, we are getting a flood of tcp packets that have both syn and fin flagged. Our system is having trouble identifying the phone/os other than "iPhone IOS" without a version number. Maybe the new update or the new phone is doing something odd.
    – user10003
    Oct 22, 2014 at 14:04
  • @ThomasNg wow .. give updates on what your campus network administrator does to handle these illegal packets.
    – MAKZ
    Oct 22, 2014 at 16:46

3 Answers 3

12

In normal TCP behavior, they should never both be set to 1 (on) in the same packet. There are many tools that exist that let you craft TCP packets, and the typical response to a packet with SYN and FIN bits set to one is a RST, since you are violating the rules of TCP.

9

One type of attack in the olden days was to have every Flags set to 1. That was:

  • Nonce
  • CWR
  • ECN-ECHO
  • URGENT
  • ACK
  • Push
  • RST
  • SYN
  • FIN

A few implementation of IP stacks didn't check correctly and crashed. It was called a Christmas Tree Packet

2
  • While this is interesting information, it really just barely touches on an answer to "can both be set to 1" by providing an example.
    – YLearn
    Oct 22, 2014 at 15:36
  • It was more intended as a comment to the previous answer, but as comments are pretty limited format-wise, I thought it was better to do a separate answer Oct 22, 2014 at 17:10
3

The response depends on the type of Operating System.

The combination of SYN and FIN flag being set in TCP header is illegal and it belongs to the category of illegal/abnormal flag combination because it calls for both establishment of connection(via SYN) and termination of connection(via FIN).

The method to handle such illegal/abnormal flag combinations is not conveyed in the RFC of TCP. So, such illegal/abnormal flag combinations are handled differently in various operating systems. Different operating system also generate different kind of responses for such packets.

This is a very big concern for security community because attackers shall exploit these response packets to determine the type of OS on the target system to craft his attack. So, such flag combinations are always treated as malicious and modern intrusion detection systems detect such combinations to avoid attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.