Skip to main content
Share Your Experience: Take the 2024 Developer Survey
14 votes
Accepted

Is a FIN only segment legal?

All the research of half an hour says that FIN-only is never legitimate. http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html Packets should never contain just a ...
Marc 'netztier' Luethi's user avatar
12 votes
Accepted

How does NAT Stitching work?

You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
Ron Maupin's user avatar
  • 99.8k
11 votes

How would a firewall kill a TCP connection without RST or FIN?

You don't mention the kind of firewall, but I suspect most simply drop the packets. I have a Wireshark dump on server side and I tried to find if firewall sends a FIN or RST with ip.dst==serverip ...
Ron Trunk's user avatar
  • 67.6k
11 votes

Do I get any security benefits by NATing a network that's already behind a firewall?

No. I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses. NAT only add complexity without increasing security, if the network and the ...
JFL's user avatar
  • 19.7k
10 votes

How does Deep Packet Inspection work with encrypted packets?

As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
YLearn's user avatar
  • 27.4k
10 votes

Difference between firewall and ACL

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
Ron Trunk's user avatar
  • 67.6k
8 votes
Accepted

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s? This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
YLearn's user avatar
  • 27.4k
7 votes

The use of DMZ and single firewall design

While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
Ricky's user avatar
  • 32.2k
6 votes

How would a firewall kill a TCP connection without RST or FIN?

Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour. I personally ...
Jeremy Gibbons's user avatar
6 votes

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
Ron Maupin's user avatar
  • 99.8k
6 votes
Accepted

How does Deep Packet Inspection work with encrypted packets?

For the actual payload inspection you need to break the encryption. That is the only way to detect drive-by malware downloads and similar threats. The usual way that works is the same way as a man-in-...
Zac67's user avatar
  • 84.8k
5 votes
Accepted

What are the advantages of a firewall over a Layer-3 switch?

Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
Steffen Ullrich's user avatar
5 votes
Accepted

VLANS vs. subnets for network security and segmentation

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
Peter Green's user avatar
  • 13.3k
5 votes
Accepted

Urgent: how to configure different interface using same ip subnet in asa 5506?

The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
Ron Trunk's user avatar
  • 67.6k
5 votes

Cisco ASA 5585X Internal-Data0/1 interface errors

From Cisco tech note: The ASA interface error counter "overrun" tracks the number of times that a packet was received on the network interface, but there was no available space in the interface ...
Ron Trunk's user avatar
  • 67.6k
5 votes
Accepted

If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet?

A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports ...
Steffen Ullrich's user avatar
5 votes
Accepted

What is the difference between an ASA firewall and UTM firewall?

An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
Jesse P.'s user avatar
  • 4,690
5 votes
Accepted

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
FrameHowitzer's user avatar
4 votes
Accepted

Is it possible to tell if a firewall is present on my network path?

Traffic can be routed between VLANs by a router, there is no requirement for a firewall (which ultimately is really a router with some filtering features, anyway). There is no way to say for sure ...
Jeremy Gibbons's user avatar
4 votes

How to configure FTP in Cisco Meraki?

Active and Passive FTP Overview and Configuration Under Security Appliance > Firewall, configure a 1:1 NAT with the allowed inbound connections. Two firewall rules are necessary for passive FTP to ...
hackbac's user avatar
  • 96
4 votes
Accepted

Cisco IP Fragments ACL strange behavior

Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped. See Access Control ...
Ron Maupin's user avatar
  • 99.8k
4 votes
Accepted

Is somebody trying to hack me?

Does this mean that someone is trying to get login over SSH/Telnet to my ASA? Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you ...
Ron Trunk's user avatar
  • 67.6k
4 votes
Accepted

TCP connection dropped and each endpoint points at the other one as responsible of closing it

I've seen firewalls exhibit this exact behaviour in the wild when troubleshooting issues, spoofing RST packets. When running a capture on one end of the connection the RST will appear to be ...
Mark Riddell's user avatar
4 votes
Accepted

Is it possible to block flash at the firewall without SSL interception?

In a word: NO If you aren't decoding the SSL stream, you have no idea what's in it.
Ricky's user avatar
  • 32.2k
4 votes
Accepted

How can i open a group of ports in ASA 5512?

You need to configure Access Rules. Below is an example to get you started. You need to build yours to suit your needs. hostname(config)# access-list outside_access extended permit tcp any object ...
Ronnie Royston's user avatar
4 votes

How to calculate throughput in Kpps?

The bandwidth test will not help you properly determine your firewall needs, as it is only testing how much available bandwidth you have. Graphing either through RouterOS or through a third party ...
Brian Winning Jr.'s user avatar
4 votes
Accepted

How can I disable temporarily Cisco AnyConnect user from ASDM?

From ASDM: Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users. Select the user you want to configure and click Edit. In the left-hand pane, click VPN Policy. Specify the number ...
hertitu's user avatar
  • 2,658
4 votes
Accepted

Are firewall zones implemented similarly to VLANs and subnets?

This is Zone Based Firewalling. There are no hard and fast rules as to how you relate your zones to your VLANs but you might for example have 4 VLANs: HR, Finance, Manufacturing and Marketing. You ...
Osyrus Solutions's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible