Re: SYN+FIN packets legal?

Jamie Lokier (lkd@tantalophile.demon.co.uk)
Sun, 13 Dec 1998 17:05:16 +0000


On Sun, Dec 13, 1998 at 03:07:30AM +0100, Roger Espel Llima wrote:
> xervavi Alan Cox lio linux-kernel:
> > SYN|FIN is legal TCP. If you ever see it be suspicious however. The only
> > legitimate cause of it is T/TCP which is an experimental protocol nobody
> > is supposed to use
>
> FreeBSD used to do T/TCP in a number of cases, including the 'finger'
> command. I don't know if they've come back to their senses since...

Last time I read the T/TCP document, it looked like a broken protocol
w.r.t. timestamps & PAWS. But I digress... (I could have been paranoid
that day).

Linux contains a comment to the effect that KA9Q sends out data with the
initial return SYN+ACK, though we ignore it. Both those behaviours look
legal according to my reading of RFC793. And it suggests a FIN could be
tacked on the end of such a packet, maybe?

If so, SYN+ACK+FIN is legal, but not SYN+FIN.

-- Jamie

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/