7

Nov 29 15:17:15 hostname kernel: [397768.554884] [UFW BLOCK] IN=eth0 OUT= MAC=[mac] SRC=[ip] DST=[ip] LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=17050 PROTO=TCP SPT=56152 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0

As I understand it, there was a request to port 80, which was blocked. Most of the messages have DPT=80.

Which is weird, since port 80 is open for business and serving websites like never before. What am I missing here?

Roman
  • 3,907
  • 3
  • 21
  • 34
Markus Hedlund
  • 1,127
  • 2
  • 19
  • 33

1 Answers1

13

Notice that your packet has both the FIN and ACK bits set. This is the last packet that the remote host sends in the TCP tear down (end of connection) procedure.

What happens is, when your host has finished sending it sets the FIN and ACK flags on the last packet. The remote hosts sends a packet with ACK set followed by a packet with FIN and ACK set.

Local          remote
FIN ACK ---->
        <----  ACK
        <----  FIN ACK (?optional?)
ACK     ----->

In practice, the remotes FIN ACK is considered optional so the netfilter firewall will flush it's connection table when it sees the ACK so when the FIN ACK packet arrives it has no associated connection and is dropped.

user9517
  • 115,471
  • 20
  • 215
  • 297
  • 1
    Well, this really makes logging stuff from iptables/UFW pointless, thanks for the clarification. – Kzqai Jul 01 '13 at 19:20