Is this a Legitimate "fist packet isn't SYN drop"?

Stefano_Cappell — Thu, 22 Oct 2020 14:27:15 GMT

We have this transaction that, in this example, startsat 11:00. At 11.02 the remote server tries to close it sending the FIN but the local server tries to close it only half an hour later (at 11.30). This FIN packet gets retransmitted but no ack is sent by the remote server. At last the local server sends a RST

My problem here is that those Resets (and sometimes some final FIN ACK packet as well) get blocked by our Checkpoint as a "first packet isn't SYN"

Is this legitimate? the tcp session timeout configured for the firewall is 3600. Is this because those packet are past both side FIN packet and the TCP end timeout is set (by default) at 5 seconds?

thanks

Re: Is this a Legitimate "fist packet isn't SYN drop"?

PhoneBoy — Sat, 24 Oct 2020 23:27:54 GMT

Seems legit to me, as FIN would start the TCP end timer and remove it from the main connection table.
As such, it would see that FIN packet 28 mins later as a “new” connection, thus you get the message.

topic Is this a Legitimate "fist packet isn't SYN drop"? in Firewall and Security Management

Is this a Legitimate "fist packet isn't SYN drop"?

Re: Is this a Legitimate "fist packet isn't SYN drop"?