D-Link NetDefendOS User Manual page 856

Chapter 13: Advanced Settings
These two flags should not be turned on at the same time as it could pose a crash risk for poorly
implemented TCP stacks. However, some Apple MAC systems implement TCP in a non-standard
way, meaning that they always send out SYN packets with the PSH flag turned on. This is why
NetDefendOS normally removes the PSH flag and allows the packet through despite the fact that
such packets would be dropped if standards were strictly followed.
Default: StripSilent
TCP SYN/RST
The TCP RST flag together with SYN; normally invalid (strip=strip RST).
Default: DropLog
TCP SYN/FIN
The TCP FIN flag together with SYN; normally invalid (strip=strip FIN).
Default: DropLog
TCP FIN/URG
Specifies how NetDefendOS will deal with TCP packets with both FIN (Finish, close connection)
and URG flags turned on. This should normally never occur, as it is not usually attempted to close
a connection at the same time as sending "important" data. This flag combination could be used
to crash poorly implemented TCP stacks and is also used by OS Fingerprinting.
Default: DropLog
TCP URG
Specifies how NetDefendOS will deal with TCP packets with the URG flag turned on, regardless of
any other flags. Many TCP stacks and applications deal with Urgent flags in the wrong way and
can, in the worst case scenario, cease working. Note however that some programs, such as FTP
and MS SQL Server, nearly always use the URG flag.
Default: StripLog
TCPE ECN
Specifies how NetDefendOS will deal with TCP packets with either the Xmas or Ymas flag turned
on. These flags are currently mostly used by OS Fingerprinting.
It should be noted that a developing standard called Explicit Congestion Notification also makes
use of these TCP flags, but as long as there are only a few operating systems supporting this
standard, the flags should be stripped.
Default: StripLog
TCP Reserved Field
Specifies how NetDefendOS will deal with information present in the "reserved field" in the TCP
header, which should normally be 0. This field is not the same as the Xmas and Ymas flags. Used
by OS Fingerprinting.
856