Actions
Bug #3844
closedtcp: possible bypass with TCP ssn reuse
Affected Versions:
Effort:
Difficulty:
Label:
Description
Scenario:
client: TCP SYN packet 1
server: RST with 'broken ACK' (so ACK field non-zero while ACK flag not set)
client: TCP SYN packet 2
...
The 2nd SYN packet is not considered for TCP ssn reuse as the "state" of the session is not progressed enough.
So the SYNs with their odd RSTs seem to trigger a condition where the apparently valid session following it is not picked up.
Actions