Thread View: comp.security.firewalls
11 messages
11 total messages
Started by mayer hans
Fri, 05 Oct 2001 18:56
CP FW-1 next generation: TCP Packet out of state
Author: mayer hans
Date: Fri, 05 Oct 2001 18:56
Date: Fri, 05 Oct 2001 18:56
15 lines
1531 bytes
1531 bytes
hi all i installed cp next generation on sparc solaris 8 and see a lot of messages like this in the log with service "notes": th-flags 11 message info: TCP Packet out of state. any idea, what to do ? it seams, that those packets are droped. -- best regards from vienna | hans | mayer (at) relay.bfl.at_SPAM
Re: CP FW-1 next generation: TCP Packet out of state
Author: maus743
Date: Fri, 05 Oct 2001 19:11
Date: Fri, 05 Oct 2001 19:11
22 lines
1452 bytes
1452 bytes
" mayer hans " <mayer@relay.bfl.at> wrote in message news:1002308196.894052@bfl-ea1... > > hi all > > i installed cp next generation on sparc solaris 8 > and see a lot of messages like this in the log > with service "notes": > > th-flags 11 message info: TCP Packet out of state. > > any idea, what to do ? > it seams, that those packets are droped. > > -- > best regards from vienna | > hans | mayer (at) relay.bfl.at_SPAM > Grab the hotfix. ws
Re: CP FW-1 next generation: TCP Packet out of state
Author: Neil Desai
Date: Sat, 06 Oct 2001 22:25
Date: Sat, 06 Oct 2001 22:25
21 lines
1675 bytes
1675 bytes
You might want to increase the TCP timeout or change the parameters to allow non SYN packets to create and entry in the state table. Neil " mayer hans " <mayer@relay.bfl.at> wrote in message news:1002308196.894052@bfl-ea1... > > hi all > > i installed cp next generation on sparc solaris 8 > and see a lot of messages like this in the log > with service "notes": > > th-flags 11 message info: TCP Packet out of state. > > any idea, what to do ? > it seams, that those packets are droped. > > -- > best regards from vienna | > hans | mayer (at) relay.bfl.at_SPAM >
Re: CP FW-1 next generation: TCP Packet out of state
Author: Wayne McGlinn
Date: Sun, 07 Oct 2001 04:51
Date: Sun, 07 Oct 2001 04:51
16 lines
1648 bytes
1648 bytes
"Neil Desai" <ndesai01@tampabay.rr.com> wrote in message news:tbYpWUrTBHA.254@dogwood.us.checkpoint.com... > You might want to increase the TCP timeout or change the parameters to allow > non SYN packets to create and entry in the state table. > Neil <snip> NO. There are well known vulnerabilities that are then opened. Check http://www.enteract.com/lspitz and read Lance's explanation of the state table before even considering allowing non SYN packets to create an entry in the state table. Wayne McGlinn Brisbane, Oz
Re: CP FW-1 next generation: TCP Packet out of state
Author: mayer hans
Date: Sun, 07 Oct 2001 15:22
Date: Sun, 07 Oct 2001 15:22
17 lines
1811 bytes
1811 bytes
In article <4G7MmDdTBHA.114@dogwood.us.checkpoint.com>, maus743 <maus743@milpool.net> wrote: >" mayer hans " <mayer@relay.bfl.at> wrote in message >news:1002308196.894052@bfl-ea1... > >Grab the hotfix. > thanks for reply. does this solve the problem, i didn't found nothing about this in the release notes. but i will install it. ( hf2 of course ) i couldn't find hf1, but maybe hf2 includes hf1 -- best regards from vienna | hans | mayer (at) relay.bfl.at_SPAM
Re: CP FW-1 next generation: TCP Packet out of state
Author: mayer hans
Date: Sun, 07 Oct 2001 15:36
Date: Sun, 07 Oct 2001 15:36
24 lines
1859 bytes
1859 bytes
hi neil thanks for reply TCP timeout is default ( and as before at old release ) with 3600 sec but the problem occurs within 1 hour. currently i have no access to cp ng only version 4.1 is this the same parameter in fwui_head.def as in 4.1 ? #define ALLOW_NON_SYN_RULEBASE_MATCH In article <tbYpWUrTBHA.254@dogwood.us.checkpoint.com>, Neil Desai <ndesai01@tampabay.rr.com> wrote: > >You might want to increase the TCP timeout or change the parameters to allow >non SYN packets to create and entry in the state table. >Neil -- best regards from vienna | hans | mayer (at) relay.bfl.at_SPAM
Re: CP FW-1 next generation: TCP Packet out of state
Author: mayer hans
Date: Sun, 07 Oct 2001 15:42
Date: Sun, 07 Oct 2001 15:42
16 lines
1732 bytes
1732 bytes
hi Wayne thanks for reply In article <$l8scruTBHA.118@dogwood.us.checkpoint.com>, Wayne McGlinn <wayne.mcglinn@didata.com.au> wrote: >http://www.enteract.com/lspitz and read Lance's explanation of the state ============================== my browser says: url not found -- best regards from vienna | hans | mayer (at) relay.bfl.at_SPAM
Re: CP FW-1 next generation: TCP Packet out of state
Author: Neil Desai
Date: Mon, 08 Oct 2001 03:43
Date: Mon, 08 Oct 2001 03:43
32 lines
2274 bytes
2274 bytes
To expose the vulnerabilities that are on Lance's site you would have to have the following things: 1. A rule to allow the traffic. 2. The hosts that are in the above rule would have to be down. What is going to happen is that a NON SYN packet will go through the rulebase and if it makes a match then it will go into the state table. If it does not make a match in the rulebase then it will not be entered in the state table. Neil "Wayne McGlinn" <wayne.mcglinn@didata.com.au> wrote in message news:$l8scruTBHA.118@dogwood.us.checkpoint.com... > > "Neil Desai" <ndesai01@tampabay.rr.com> wrote in message > news:tbYpWUrTBHA.254@dogwood.us.checkpoint.com... > > You might want to increase the TCP timeout or change the parameters to > allow > > non SYN packets to create and entry in the state table. > > Neil > <snip> > > NO. There are well known vulnerabilities that are then opened. Check > http://www.enteract.com/lspitz and read Lance's explanation of the state > table before even considering allowing non SYN packets to create an entry in > the state table. > > Wayne McGlinn > Brisbane, Oz > >
Re: CP FW-1 next generation: TCP Packet out of state
Author: Wayne McGlinn
Date: Mon, 08 Oct 2001 07:32
Date: Mon, 08 Oct 2001 07:32
23 lines
1957 bytes
1957 bytes
sorry, try http://www.enteract.com/~lspitz Wayne " mayer hans " <mayer@relay.bfl.at> wrote in message news:1002469370.653881@bfl-ea1... > > hi Wayne > > thanks for reply > > In article <$l8scruTBHA.118@dogwood.us.checkpoint.com>, > Wayne McGlinn <wayne.mcglinn@didata.com.au> wrote: > >http://www.enteract.com/lspitz and read Lance's explanation of the state > ============================== > > my browser says: url not found > > > -- > best regards from vienna | > hans | mayer (at) relay.bfl.at_SPAM >
Re: CP FW-1 next generation: TCP Packet out of state
Author: maus743
Date: Mon, 08 Oct 2001 13:48
Date: Mon, 08 Oct 2001 13:48
20 lines
1785 bytes
1785 bytes
" mayer hans " <mayer@relay.bfl.at> wrote in message news:1002468162.760126@bfl-ea1... > In article <4G7MmDdTBHA.114@dogwood.us.checkpoint.com>, > maus743 <maus743@milpool.net> wrote: > >" mayer hans " <mayer@relay.bfl.at> wrote in message > >news:1002308196.894052@bfl-ea1... > > > >Grab the hotfix. > > > > thanks for reply. > does this solve the problem, i didn't found nothing about > this in the release notes. but i will install it. ( hf2 of course ) > i couldn't find hf1, but maybe hf2 includes hf1 Yes - I was having the same error message for rules that worked in 4.1, and CheckPoint support suggested I get the hotfix. The knowledge base verifies that (at least HF1) fixes this problem. ws
Re: CP FW-1 next generation: TCP Packet out of state
Author: mayer hans
Date: Fri, 12 Oct 2001 10:46
Date: Fri, 12 Oct 2001 10:46
7 lines
1394 bytes
1394 bytes
OK >sorry, try http://www.enteract.com/~lspitz > >Wayne hans
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads