Security

Ask something
Discussion Locked

TCP non-syn/non-ack packet

0 helpful
1 reply

by denethor 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have WIN XP/SP1 home o/s, Norton Personal Firewall, networked to a WIN98SE computer. Symantec cannot help me with the reason for relatively frequent occurrence of the following type of message.
I would reall appreciate some help. Do you think it is a bug in NPF or something wrong with my setup?

Details: TCP non-syn/non-ack packet on invalid connection. Packet has been dropped
Source IP address: i.i.com.com(144.135.8.150)
Destination IP address: c81596(203.213.13.87)
TCP Source Port: http(80)
TCP Destination Port: 3127
TCP Message Flags: 0x00000010

Details: TCP non-syn/non-ack packet on invalid connection. Packet has been dropped
Source IP address: www.yahoo.com(66.218.71.84)
Destination IP address: c81596(203.213.13.87)TCP Source Port: http(80)
TCP Destination Port: 3056
TCP Message Flags: 0x00000010

1 reply

by joseph moore

Well, there are other types of TCP packet types other than SYN and ACK.
Normally, the 3-way TCP handshake is performed by:
1: Sender sends SYN packet to target
2: Target is alive and sends SYN/ACK packet
3: Sender acknowledges that target responded and sends an ACK packet.
In chart form, it looks like this:

SYN-->
<--SYN/ACK
ACK-->

Now, there are OTHER types of packets that can be sent. There are FIN packets, XMAS packets, NULL packets. These packet types are useful in determining if a remote system is a Windows machine or not. You see, the Windows OS line (from Win95 up to XP) do not follow the RFC guidelines for how TCP/IP communications should be handled. Therefore, Windows machines cannot process FIN, XMAS or NULL packets.
So, a person scanning for Windows systems can use a tool (like NMAP) and send out TCP FIN packets. If you get the response that Windows sends out when it sees these packets, you know it is a Windows box, and you can set your attack strategy accordingly.

The whole point of this is that there are a lot of TCP packet types. I guess that if a TCP FIN or TCP XMAS packet is dropped by the Norton firewall, this is just how it reports it.

Either way, it could be the signs that someone is port scanning you.

Don't worry about it. Your firewall is working like it should.

hope this helps

This discussion is closed to new replies.