A fin-scan involves sending a TCP segment with FIN and no other flags other than (possibly) PSH and/or URG. Are such packets ever legitimately encountered in 2019?
Note that in Is a FIN only segment legal? it was established that while a TCP segment with FIN but not ACK is legal within specification, it is accepted practise never to do so. So much so, that such segments may be considered illegitimate.
Consequently, we know that Berkeley sockets and Windows stacks never emit such segments.
Is a TCP segment with FIN but not ACK ever encountered in 2019? If so, under what circumstances.
As @Ron Maupin has noted, with Transactional TCP, "you can send a single segment with SYN, data, and FIN, but there is no ACK because there is nothing to ACK". To me, this example fits the question as posed, although it is unclear if it is encountered today. @Ron Maupin has chosen not to present it as a formal answer "because it was never widely implemented, so it is now rather obsolete. It was defined in RFC 1379, Extending TCP for Transactions, but that RFC was moved to Historic status, by RFC 6247".
- Is a TCP segment with FIN and no other TCP flags set other than possibly PSH and/or URG, ever encountered in 2019? If so, under what circumstances?
I am not looking for a hypothetical.
I have been asked to motivate this question further.
The reason behind this question is FIN scan detection.
If ACKless FINs no longer occur, then FIN scans are trivially detected: any FIN without an ACK is a scan - call the police. Most switches have options to detect and or drop such packets.
However, if such segments do still occur today, then such an approach will produce false positives (and the IDS will be switched off).
If ACKless FINs do still occur, the FIN segment would have to be tracked, the reply determining the legality of the segment.
I am about to roll out intrusion detection on a national scale in heterogeneous networks, and am concerned about encountering such packets legally today 2019.
I am asking on this site because only a network engineer at the coalface can answer.
A 100 point bounty was unable to unearth such a segment.