2

I am new to networking field can anyone explain why does my firewall gives message below

(snort_decoder) WARNING: TCP urgent pointer exceeds payload length or no payload

  • 1
    You probably should add some more details, for example which vendor and model your firewall is and so on. – waza-ari Jul 18 '16 at 8:20
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 22:02
2

Your firewall is telling you it detected a bogus TCP packet. The reason it reports these is because they might be used by bad guys to try and set up a covert channel. In this specific case the TCP fault is the use of URG (this is seldom used in TCP in practice, but is sent to tell the receiving TCP to urgently skip ahead to some point), but the point it's being told to skip ahead to is not actually in the subject packet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.