Re: Crafted Packets Handling by Firewalls

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Ofir Arkin, sie wrote:
[...]
> For example: CheckPoint Firewall-1 
[...]
> This is known and not new. But why a "state full" firewall does 
> not check for this behavior?
[...]

I believe there is a `patch' for the base INSPECT code that was made
available last year to change this behaviour.

The default mode of operation is to follow state if the usual 3-way
TCP handshake is seen.

What you're seeing is the result of the product having a fairly agressive
timeout on state information and as a result, lets any packet through with
the ACK flag set because it might be something it has forgotten about.  In
doing so, it strips the packet of data (if any) and watches to see if there
is a returned ACK or RST packet and either sets up state information or
blocks the original packet (respectively) based on the packet received from
the internal host.

Darren