First Packet isn't SYN

[Dost10]

I see a lot of First Packet isn't SYN in the fw logs and lately it has increased a lot. I saw https://support.checkpoint.com/results/sk/sk102491 as a solution and I have some questions. How correct is it to throw an exception for connections that are removed from the connection table due to a delay in the 3-way handshake and why are there so many First Packet isn't SYN? How much damage can both ways of throwing an exception or not throwing anything at all harm the normal operation of the fw. Thanks for any ideas.

[the_rock]

In my experience, that message, even in the old days or R60 and before, would usually indicate the fact that connection is not completing 3 way handshake somewhere along the way.

Did you do fw monitor to see why?

Andy

[Dost10]

Can you explain in more detail how to do this? Should I open the pcap file I received via fw monitor? If so, what parts should I pay attention to and what can I compare?

[the_rock]

Check out this site my colleague built while ago, you can build your own filter and simply copy the command. Once you have the file, dump it in wireshark and simply follow the streams.

Andy

https://tcpdump101.com/#

[the_rock]

@Dost10 Also, check out below, its super helpful.

Andy

https://www.wireshark.org/docs/wsug_html_chunked/ChapterWork.html

[Chris_Atkinson]

What version & JHF?

Is aggressive aging active and occuring?

- connection table size automatic or manual limit

- how is the memory utilisation of the gateway

Have you checked and eliminated potential routing issues resulting in asymmetrical traffic?

[Dost10]

HOTFIX_R81_20_JUMBO_HF_MAIN Take: 105.   No, currently we do not have asymmetric. Interfaces that operate in full duplex.