Oops. List moved?
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
--- Begin Message ---
I've got another FTP client doing weird things that FW-1 doesn't
seem to like, but that are strictly speaking, not illeagal.
After the SYN--SYN-ACK--ACK handshake and FTP banner go by, the client
sends a packet with the following content, "USER ", that is, it sends
the characters, U, S, E, R, and a space. At this point the firewall
sends a RST back to the client.
Now, there are a couple of problems with this. First, TCP is a stream-
oriented protocol. You can break up the data stream into as many or
as few TCP segments as you want and the end-program will see things
just fine. Therefore, sending one packet with say,
"USER "
And the next one with,
"anonymous\r\n"
Is in actuallity, totally legit. However, bad assumptions about how
much data individual TCP segments contain pop up all of the time in
all kinds of firewall proxy software. Nothing new here.
The other big problems here are that the firewall is not even rejecting
the connection properly. It does RST the client, but (1) it does not RST
the server, so the ftpd is left hanging, and (2) it does not log the
failure in any way.
All of that aside, none of the various hacks and knobs I know about or
was able to find googling deal with this kind of client behavior. Has
anyone run into this and found a way to make FW-1 play well with such
a client?
--
Crist J. Clark [EMAIL PROTECTED]
Globalstar Communications (408) 933-4387
The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.
If the reader of this e-mail is not the intended recipient, or the
employee or agent responsible to deliver it to the intended recipient,
you are hereby notified that any review, dissemination, distribution or
copying of this communication is strictly prohibited. If you have
received this e-mail in error, please contact [EMAIL PROTECTED]
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
--- End Message ---
