In our network, I captured a TCP packet by Wireshark that has no flag set.
What's that mean?
Is it normal?

  • please post sample data as well. It will help to answer your question – infra Jun 11 '19 at 10:09
  • "What's that mean?" and "due to NDA I can't" are really two things that do not work together well here. Unfortunately, your question is too broad to answer. We would need specifics. – Ron Maupin Jun 11 '19 at 13:14
  • We need enough information to answer the question. Generally we need full configurations, but public addresses and passwords should be obfuscated. You can refer to the Network Engineering Question Checklist for guidance. – Ron Maupin Jun 11 '19 at 15:40

A TCP flag is used in a packet to identify a connection state or provide further information to the receiving party, common examples include SYN, ACK, RST, FIN + more.

In your instance, you've come across a TCP packet without a proper flag set or a malformed flag set.

As for the cause, without knowing your environment I'd hesitate to comment. I'd start by capturing the source of the packet and investigating the machine/device for network anomalies.

  • it seems odd, I wonder maybe it should be a kind of new attack but I investigate further, Thanks. – R1w Jun 11 '19 at 10:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.