Subject: Segments with no flags set

From: <[email-masked]>
Date: Wed, 30 May 2001 13:33:12 -0700 (PDT)

Greetings,

I recently encountered an interoperability problem between a firewall and a
Voice-over-IP hardware device (with embedded TCP stack), where the VoIP box
would begin to send segments with no flags set (including ACK) over an
established session.  Although I've never observed such use of TCP before,
I can't find hard evidence that indicates it is a violation of spec.  Can
anyone confirm if this is truly against the law?

thanks,
-bp
--
# bryan at terran dot org
# http://www.terran.org/~bryan

---

From: "David S. Miller" <[email-masked]>
Date: Wed, 30 May 2001 14:20:07 -0700 (PDT)

> anyone confirm if this is truly against the law?

I don't see how it could be illegal, if the ACK flag bit is clear this
simply means to ignore the ACK field.

I suppose a firewall vendor could claim that this provides a 32-bit
field in which to create a covert channel of information, but the URG
field can already be (and honestly, by hardcore crackers probably is)
used for this purpose :-)

Later,
David S. Miller
[email-masked]

---

From: Greg Minshall <[email-masked]>
Date: Wed, 30 May 2001 14:56:20 -0700

the ACK bit must be set on all non-SYN packets.

RFC793, p.66, for example:
----
        Any other control or text-bearing segment (not containing SYN)
        must have an ACK and thus would be discarded by the ACK
        processing.  An incoming RST segment could not be valid, since
        it could not have been sent in response to anything sent by this
        incarnation of the connection.  So you are unlikely to get here,
        but if you do, drop the segment, and return.
----

and p. 16:
----
  Acknowledgment Number:  32 bits

    If the ACK control bit is set this field contains the value of the
    next sequence number the sender of the segment is expecting to
    receive.  Once a connection is established this is always sent.
----

cheers,  Greg Minshall