topic First Packet isn't SYN in Events

First Packet isn't SYN

Dost10 — Sat, 26 Jul 2025 12:16:51 GMT

I see a lot of First Packet isn't SYN in the fw logs and lately it has increased a lot. I saw https://support.checkpoint.com/results/sk/sk102491 as a solution and I have some questions. How correct is it to throw an exception for connections that are removed from the connection table due to a delay in the 3-way handshake and why are there so many First Packet isn't SYN? How much damage can both ways of throwing an exception or not throwing anything at all harm the normal operation of the fw. Thanks for any ideas.

Re: First Packet isn't SYN

the_rock — Sat, 26 Jul 2025 12:58:40 GMT

In my experience, that message, even in the old days or R60 and before, would usually indicate the fact that connection is not completing 3 way handshake somewhere along the way.

Did you do fw monitor to see why?

Andy

Re: First Packet isn't SYN

Chris_Atkinson — Sat, 26 Jul 2025 13:35:43 GMT

What version & JHF?

Is aggressive aging active and occuring?

- connection table size automatic or manual limit

- how is the memory utilisation of the gateway

Have you checked and eliminated potential routing issues resulting in asymmetrical traffic?

Re: First Packet isn't SYN

Dost10 — Sat, 26 Jul 2025 13:26:35 GMT

Can you explain in more detail how to do this? Should I open the pcap file I received via fw monitor? If so, what parts should I pay attention to and what can I compare?

Re: First Packet isn't SYN

the_rock — Sat, 26 Jul 2025 13:28:40 GMT

Check out this site my colleague built while ago, you can build your own filter and simply copy the command. Once you have the file, dump it in wireshark and simply follow the streams.

Andy

https://tcpdump101.com/#

Re: First Packet isn't SYN

Dost10 — Sun, 27 Jul 2025 05:50:06 GMT

HOTFIX_R81_20_JUMBO_HF_MAIN Take: 105. No, currently we do not have asymmetric. Interfaces that operate in full duplex.

Re: First Packet isn't SYN

the_rock — Sat, 26 Jul 2025 15:50:15 GMT

@Dost10 Also, check out below, its super helpful.

Andy

https://www.wireshark.org/docs/wsug_html_chunked/ChapterWork.html