10

It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply).

I have always assumed that a FIN without an ACK, while rude and rare, is legal, based on connection termination.

But then I read statements such as "A FIN will never appear by itself which is why Cisco's "established" keyword filters on ACK and/or RST packets. Only FIN/ACK is valid."

  1. Is a FIN only segment legal?
  2. If so, where might I encounter one and why?
  • 1
    According to RFC793, p. 16 "If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent." – JeanPierre Apr 20 at 17:30
  • @JeanPierre I see. Are you saying a non initiating ACKless FIN is illegal ( non initiating to distinguish from the T/TCP initiating SYNFIN. This seems contrary to what others have claimed. – fundagain Apr 20 at 21:32
  • If you have proven it is illegal per spec, please answer this (and the related question with bounty) – fundagain Apr 20 at 21:33
  • I really hope you are correct! – fundagain Apr 20 at 21:39
  • The answer to the bounty question being it would never occur! – fundagain Apr 20 at 21:44
13
+50

All the research of half an hour says that FIN-only is never legitimate.

http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html

Packets should never contain just a FIN flag. FIN packets are frequently used for port scans, network mapping and other stealth activities.

https://lists.sans.org/pipermail/list/2006-June/024563.html

Send an unsolicited ACK to an open or closed port and you will get back a plain RST. A FIN will never appear by itself which is why Cisco's "established" keyword filters on ACK and/or RST packets. Only FIN/ACK is valid.

Other Stack Exchange sites, such as https://security.stackexchange.com/, possibly https://superuser.com/, might be better in the context of discussing IDS/IPS topics.

EDIT:

(With tip'o'the hat to Ron Maupin, see his comment): The TCP RFC does not (edited, it must've been late...) explicitely state that a FIN only packet is illegal nor that a FIN flag MUST be accompanied by another flag. Still, a FIN only packet in a modern day network is something unusual, quite possibly intentional, this probably worth looking at and for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.