Tcp Flags - Cisco Catalyst 2960 series Configuration Manual

The ACEs that make up an access list can be configured to detect and drop unauthorized TCP packets by
allowing only the packets that have a very specific group of TCP flags set or not set. The ACL TCP Flags
Filtering feature provides a greater degree of packet-filtering control in the following ways:
• You can select any desired combination of TCP flags on which to filter TCP packets.
• You can configure ACEs to allow matching on a flag that is set, as well as on a flag that is not set.

TCP Flags

The table below lists the TCP flags, which are further described in RFC 793, Transmission Control Protocol.
Table 116: TCP Flags
TCP Flag
ACK
FIN
PSH
RST
SYN
URG
How to Configure ACL Support for Filtering IP Options
Filtering Packets That Contain IP Options
Complete these steps to configure an access list to filter packets that contain IP options and to verify that the
access list has been configured correctly.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
How to Configure ACL Support for Filtering IP Options
Purpose
Acknowledge flag—Indicates that the acknowledgment field
of a segment specifies the next sequence number the sender
of this segment is expecting to receive.
Finish flag—Used to clear connections.
Push flag—Indicates the data in the call should be
immediately pushed through to the receiving user.
Reset flag—Indicates that the receiver should delete the
connection without further interaction.
Synchronize flag—Used to establish connections.
Urgent flag—Indicates that the urgent field is meaningful
and must be added to the segment sequence number.
1237