Firewall Wizards mailing list archives
Crafted Packets Handling by Firewalls
From: "Ofir Arkin" <ofir () packet-technologies com>
Date: Wed, 19 Jan 2000 10:30:09 +0200
Most Firewalls will not check for the accuracy of the packet. For example: CheckPoint Firewall-1 Assume port 80 is open to the www server. It lets a SYN-ACK packet go throw when no SYN was first sent from the probing host. SYN-ACK is not the only example, SYN-FIN, RST , FIN, FIN-ACK basically any TCP flag crafted packet. This is known and not new. But why a "state full" firewall does not check for this behavior? The question is why firewalls do not check for accuracy of some TCP/IP suite traffic. This is a BASIC thing to check. I am not arguing that a firewall should validate all traffic but it should at least check for abnormalities that are so obvious. This should also eliminate some of the OS detection methods. Sure you can avoid some of the OS detection methods by tweaking your open source kernel. I agree with Sipmle Nomad. But what can you do when you are not dealing with open source? -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Ofir Arkin Tel: 972-3-5587001 Security QA Manager Fax: 972-3-5587003 Packet Technologies http://www.packet-technologies.com ofir () packet-technologies com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Current thread:
- Crafted Packets Handling by Firewalls Ofir Arkin (Jan 19)
- Re: Crafted Packets Handling by Firewalls Aaron D. Turner (Jan 20)
- Re: Crafted Packets Handling by Firewalls Darren Reed (Jan 20)
- <Possible follow-ups>
- Re: Crafted Packets Handling by Firewalls Ryan Russell (Jan 20)
- Re: Crafted Packets Handling by Firewalls Steve . Bleazard (Jan 20)