If you'll excuse me for digging this back up, there was one other
reason to send back TCP RSTs in response to "strange" TCP packets
(rather than just ignore them) and that is to stop miscreants from
using your firewall as a helping hand in launching an IP spoofing
attack.
With "silent" dropping of SYN-ACK packets, not destined for any
specific port and inbound to you with tight packet filtering policies,
it is possible for an "attacker" to use this to his advantage in
building an IP spoofing attack - no need to jam up a particular
(open) TCP port. As far as I know, only Cisco and Livingston (?)
make particular usage of an "established" type filter keyword that
uses the SYN-ACK packet.
This is generally only useful if the miscreant is only concerned with
generating false information (such as sending fake mail, etc) but has
other potential.
darren
References:
|
|
