D-Link DFL-260E User Manual page 518

13.2. TCP Level Settings
Chapter 13. Advanced Settings
TCP SYN/FIN
The TCP FIN flag together with SYN; normally invalid (strip=strip FIN).
Default: DropLog
TCP FIN/URG
Specifies how NetDefendOS will deal with TCP packets with both FIN (Finish, close connection)
and URG flags turned on. This should normally never occur, as it is not usually attempted to close a
connection at the same time as sending "important" data. This flag combination could be used to
crash poorly implemented TCP stacks and is also used by OS Fingerprinting.
Default: DropLog
TCP URG
Specifies how NetDefendOS will deal with TCP packets with the URG flag turned on, regardless of
any other flags. Many TCP stacks and applications deal with Urgent flags in the wrong way and can,
in the worst case scenario, cease working. Note however that some programs, such as FTP and MS
SQL Server, nearly always use the URG flag.
Default: StripLog
TCPE ECN
Specifies how NetDefendOS will deal with TCP packets with either the Xmas or Ymas flag turned
on. These flags are currently mostly used by OS Fingerprinting.
It should be noted that a developing standard called Explicit Congestion Notification also makes use
of these TCP flags, but as long as there are only a few operating systems supporting this standard,
the flags should be stripped.
Default: StripLog
TCP Reserved Field
Specifies how NetDefendOS will deal with information present in the "reserved field" in the TCP
header, which should normally be 0. This field is not the same as the Xmas and Ymas flags. Used by
OS Fingerprinting.
Default: DropLog
TCP NULL
Specifies how NetDefendOS will deal with TCP packets that do not have any of the SYN, ACK,
FIN or RST flags turned on. According to the TCP standard, such packets are illegal and are used by
both OS Fingerprinting and stealth port scanners, as some firewalls are unable to detect them.
Default: DropLog
TCP Sequence Numbers
Determines if the sequence number range occupied by a TCP segment will be compared to the
receive window announced by the receiving peer before the segment is forwarded.
518