Home / server / Questions / 375764
Accepted
Kris
Asked: 2012-04-02 15:32:56 +0800 CST

What happens to tcp packets when they are unable to finish the 3 way handshake?

  • 772

Firewall for a virtual dedicated server.
I was looking into how to prevent a FIN scan and it got me thinking about the consequences.
A lot of people are using this rule:

-p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP

So when someone sends me a packet with a FIN = 1 , I'm unable to send FIN/ACK back.
It seems unlikely but does that mean my established connection won't be stopped ?
How does that work ? Does my connection stay alive and if so, for how long ?

How does that actually work when someone closes his / her browser ? It sends a FIN to my server, my server replies with FIN/ACK ... but the browser is unable to receive that, right ? Who gets the packet, where does it go ?

And what if ... a remote machine sends my server a SYN, my reply is SYN/ACK and let's say that I'm not getting the ACK back, how long is my server waiting for it ?

Is there a name for unfinished 3 way handshakes ? Thank you.

iptables tcp flags

1 Answers

  1. Best Answer

    Is there a name for unfinished 3 way handshakes

    This is called a half-open connection.

    So when someone sends me a packet with a FIN = 1 , I'm unable to send FIN/ACK back. It seems unlikely but does that mean my established connection won't be stopped? How does that work ? Does my connection stay alive and if so, for how long?

    It will eventually timeout. See also the TIME_WAIT state.

    • 9