Is a TCP segment with FIN but not ACK ever encountered today?

Question

A fin-scan involves sending a TCP segment with FIN and no other flags other than (possibly) PSH and/or URG. Are such packets ever legitimately encountered in 2019?

Note that in Is a FIN only segment legal? it was established that while a TCP segment with FIN but not ACK is legal within specification, it is accepted practise never to do so. So much so, that such segments may be considered illegitimate.

Consequently, we know that Berkeley sockets and Windows stacks never emit such segments.

---

• Is a TCP segment with FIN but not ACK ever encountered in 2019? If so, under what circumstances.

• As @Ron Maupin has noted, with Transactional TCP, "you can send a single segment with SYN, data, and FIN, but there is no ACK because there is nothing to ACK". To me, this example fits the question as posed, although it is unclear if it is encountered today. @Ron Maupin has chosen not to present it as a formal answer "because it was never widely implemented, so it is now rather obsolete. It was defined in RFC 1379, Extending TCP for Transactions, but that RFC was moved to Historic status, by RFC 6247".

---

• Is a TCP segment with FIN and no other TCP flags set other than possibly PSH and/or URG, ever encountered in 2019? If so, under what circumstances?

I am not looking for a hypothetical.

---

I have been asked to motivate this question further.

The reason behind this question is FIN scan detection.

• If ACKless FINs no longer occur, then FIN scans are trivially detected: any FIN without an ACK is a scan - call the police. Most switches have options to detect and or drop such packets.

• However, if such segments do still occur today, then such an approach will produce false positives (and the IDS will be switched off).

• If ACKless FINs do still occur, the FIN segment would have to be tracked, the reply determining the legality of the segment.

I am about to roll out intrusion detection on a national scale in heterogeneous networks, and am concerned about encountering such packets legally today 2019.

I am asking on this site because only a network engineer at the coalface can answer.

---

Historical Note

A 100 point bounty was unable to unearth such a segment.

Answer 1

This isn't an answer in itself, but might help.

Many years ago my team had a similar question about what was encountered in the wild (I believe the actual question was about ICMP variations). So we devised an experiment:

• Clarified our exact questions
• Devised the exact Cisco ACLs and commands required to do the survey
• Wrote up the testing regime (interfaces like X, time of day, length of time)

Then asked everyone suitable we knew in different organisations and ISPs to run the tests for us. We were glad we did: we got some real surprises. We shared the data with all the people who helped us.

Can you run a test survey like that?

Answer 2

Nowadays TCP traffic is in general state-full (controlled by the TCP states). This states are define on the RFC and depending on the operating system (Cisco, FreeBSD, Linux and so on) respond to combination of TCP flags in some way or in other. This is why some tools can detect the operating system just depending on the TCP flags and other options and some TCP Stacks can be configured to respond different to specific packets depending on configuration (for example in Linux via /proc). The implementation of the responses of wrong combination of TCP flags depends on the operating system, some of them follows the RFC in a very strict way and others are more relaxed, bear in mind that there is a lot of TCP Stacks on the internet and a lot of freak people sending strange TCP segments (with hping3 for example) for find issues on the TCP stacks so to the question if the FIN segment can be found on the internet my response is yes, basically you can pcap some traffic on a inbound device on a firewall and the amount of crap that there is in general is high depending on the traffic. Hope it helps a bit to clarify the question.