Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply).
I have always assumed that a FIN without an ACK, while rude and rare, is legal, based on connection termination.
But then I read statements such as "A FIN will never appear by itself which is why Cisco's "established" keyword filters on ACK and/or RST packets. Only FIN/ACK is valid."
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a FIN flag. FIN packets are frequently used for port scans, network mapping and other stealth activities.
https://lists.sans.org/pipermail/list/2006-June/024563.html
Send an unsolicited ACK to an open or closed port and you will get back a plain RST. A FIN will never appear by itself which is why Cisco's "established" keyword filters on ACK and/or RST packets. Only FIN/ACK is valid.
Other Stack Exchange sites, such as https://security.stackexchange.com/, possibly https://superuser.com/, might be better in the context of discussing IDS/IPS topics.
EDIT:
(With tip'o'the hat to Ron Maupin, see his comment): The TCP RFC does not (edited, it must've been late...) explicitely state that a FIN only packet is illegal nor that a FIN flag MUST be accompanied by another flag. Still, a FIN only packet in a modern day network is something unusual, quite possibly intentional, this probably worth looking at and for.
