D-Link DFL-260E User Manual page 517

13.2. TCP Level Settings
Chapter 13. Advanced Settings
initially intended to be used in negotiating for the use of better checksums in TCP. However, these
are not understood by any today's standard systems. As NetDefendOS cannot understand checksum
algorithms other than the standard algorithm, these options can never be accepted. The
ALTCHKREQ option is normally never seen on modern networks.
Default: StripLog
TCP Option ALTCHKDATA
Determines how NetDefendOS will handle alternate checksum data options. These options are used
to transport alternate checksums where permitted by ALTCHKREQ above. Normally never seen on
modern networks.
Default: StripLog
TCP Option Con Timeout
Determines how NetDefendOS will handle connection count options.
Default: StripLogBad
TCP Option Other
Specifies how NetDefendOS will deal with TCP options not covered by the above settings. These
options usually never appear on modern networks.
Default: StripLog
TCP SYN/URG
Specifies how NetDefendOS will deal with TCP packets with SYN (synchronize) flags and URG
(urgent data) flags both turned on. The presence of a SYN flag indicates that a new connection is in
the process of being opened, and an URG flag means that the packet contains data requiring urgent
attention. These two flags should not be turned on in a single packet as they are used exclusively to
crash computers with poorly implemented TCP stacks.
Default: DropLog
TCP SYN/PSH
Specifies how NetDefendOS will deal with TCP packets with SYN and PSH (push) flags both
turned on. The PSH flag means that the recipient stack should immediately send the information in
the packet to the destination application in the computer.
These two flags should not be turned on at the same time as it could pose a crash risk for poorly
implemented TCP stacks. However, some Apple MAC systems implement TCP in a non-standard
way, meaning that they always send out SYN packets with the PSH flag turned on. This is why
NetDefendOS normally removes the PSH flag and allows the packet through despite the fact that
such packets would be dropped if standards were strictly followed.
Default: StripSilent
TCP SYN/RST
The TCP RST flag together with SYN; normally invalid (strip=strip RST).
Default: DropLog
517