topic Re: Filter out logs for "First packet isn't SYN"? in Firewall and Security Management

Filter out logs for "First packet isn't SYN"?

r1der — Fri, 20 Jan 2023 23:06:35 GMT

Hi All,

Is there a way to filter out logs for websites that have a drop for "First packet isn't SYN"?

I'm trying to find whether a website was blocked due to the firewall, and sort out the logs by username/not action:accept, but the "First Packet isn't SYN" logs are burying the logs I want to see.

Hardware: 6000 series
Smb: Smart-1 410
Version: R81.10 take 79

Thanks!

Re: Filter out logs for "First packet isn't SYN"?

the_rock — Sat, 21 Jan 2023 02:12:58 GMT

Sorry, apologies mate, I dont have access to the dashboard now, but I recall doing similar filter before and you can do something like this -> NOT "First packet isnt SYN" or if you look at any logs containing that message, find the column containing those words and then right click on it and select the filter, that works as well.

Re: Filter out logs for "First packet isn't SYN"?

G_W_Albrecht — Sat, 21 Jan 2023 09:15:09 GMT

I would try to get rid of the First packet isn't SYN messages first, does not look healthy at all !

Re: Filter out logs for "First packet isn't SYN"?

r1der — Mon, 23 Jan 2023 22:35:13 GMT

Thanks @the_rock, you rock!

I thought I tried it that way (123.456.789 and NOT "First packet isn't SYN") but maybe I had something off. That works.

Re: Filter out logs for "First packet isn't SYN"?

the_rock — Mon, 23 Jan 2023 22:37:23 GMT

Glad it helped mate! By the way, I just like to think Im like REAL Rock (Dwayne Johnson), but in reality, compared to him, Im more Mr Pebble ; - )

Cheers.

Re: Filter out logs for "First packet isn't SYN"?

r1der — Mon, 23 Jan 2023 22:43:12 GMT

@G_W_Albrecht Thanks, I'm really confused about the First packet isn't SYN errors. I've read so much about it; I don't know which to believe anymore.
I even opened a case with support previously about it, and they told me its regular to see those. Some threads here even say its normal. Is there a way you suggest I can get rid of them? I wouldn't even know how to get a hold of some of the web developers for the sites that are showing these "blocks" for First packet isn't SYN.

Note: I don't have https inspection checked yet.

Re: Filter out logs for "First packet isn't SYN"?

the_rock — Mon, 23 Jan 2023 22:47:07 GMT

Man, thats tricky one...whoever says those messages are normal, I would not say they are right, BUT, they are not wrong either. It really depends the situation...you will see those messages ANY TIME when connection is out of order. So as we all know, you got 3-way handshake, SYN <-> SYN-ACK<-> ACK. So, at the end of the day, message clearly tells you thats not happening, the hardest part is figuring out WHY NOT.

Re: Filter out logs for "First packet isn't SYN"?

G_W_Albrecht — Tue, 24 Jan 2023 07:22:32 GMT

Usually, this is caused by asymmetrical routing - e.g. same connection packets arriving from different IFs.