Crafted Packets Handling by Firewalls

["Ofir Arkin" <ofir () packet-technologies com>]

Most Firewalls will not check for the accuracy of the packet.

For example: CheckPoint Firewall-1 

Assume port 80 is open to the www server. It lets a SYN-ACK 
packet go throw  when no SYN was first sent from the probing host. 
SYN-ACK is not the only example, SYN-FIN, RST , FIN,
FIN-ACK basically any TCP flag crafted packet.

This is known and not new. But why a "state full" firewall does 
not check for this behavior?

The question is why firewalls do not check for accuracy of
some TCP/IP suite traffic.

This is a BASIC thing to check.

I am not arguing that a firewall should validate all traffic
but it should at least check for abnormalities that are so 
obvious.

This should also eliminate some of the OS detection
methods. 

Sure you can avoid some of the OS detection methods by tweaking 
your open source kernel. I agree with Sipmle Nomad.

But what can you do when you are not dealing with open source?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Ofir Arkin                      Tel: 972-3-5587001     
Security QA Manager    Fax: 972-3-5587003
Packet Technologies     http://www.packet-technologies.com
                                   ofir () packet-technologies com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-