RE: [fw-wiz] Help me interpret these log entries....

-----Original Message-----
Subject: [fw-wiz] Help me interpret these log entries....

I am seeing many of the following lines in the logs from my PIX:

%PIX-4-106100: access-list 101 denied tcp outside/s.s.s.s(80) ->
inside/d.d.d.d(xxx)

where 1024 < xxx < 65535


The closest thing I can think of is that this is some sort of TCP reset
attack. Is this
correct?

Actually, it's probably not an attack at all. It's a common symptom of TCP
connections over stateful firewalls. Look through your log and you will
probably see within close proximity a permit entry (Built TCP ...) from
d.d.d.d to s.s.s.s. Although if d.d.d.d is a global NAT address, you will
probably see the original client address and a source port that doesn't
match (because source ports change with global NAT / PAT).

What happens is that the firewall has already seen the client close the
connection (either via RST or FIN) and has deleted the entry from the state
table. The server tries to send FIN+ACK like it's supposed to, but isn't
fast enough and the firewall drops the packet because it doesn't match
anything in the state table.

More here:

http://seclists.org/lists/firewall-wizards/2005/Jun/0054.html


PaulM




_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxx
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: DROP or REJECT that is the question...
    ... TCP is a TCP reset. ... expose at least one TCP port to the outside world, ... Your firewall policy should ... TCP since idle scans are generally a TCP-only attack. ...
    (Pen-Test)
  • RE: Increase in TCP 6129 (Dameware) scans?
    ... firewall drops unauthorized SYN packets, ... the 2 or 3 tries that most applications requesting TCP ... Also, with the single source port, I bet these scans ... Do you Yahoo!? ...
    (Incidents)
  • RE: [Full-Disclosure] Sidewinder G2
    ... Secure Computing Sidewinder G2 Firewall Stops New High-Profile Sendmail ... Technology Prevents Sendmail Attack Warned About in CERT Advisory ...
    (Full-Disclosure)
  • RE: Thinking about Security rules...
    ... > Subject: Re: Thinking about Security rules... ... >>rules for the IDS. ... by which you attack. ... firewalls in series isn't nearly as nice as a stateful firewall coupled ...
    (Vuln-Dev)
  • Re: Can I protect myself against network attacks?
    ... > I guess that was one purpose of the attack. ... > had happened if you just used the SP2 firewall which does not warn you ... back, I've seen the firewall crash before my eyes, without warning. ... network attacks, or trojans. ...
    (comp.security.firewalls)