Invalid TCP Flags ??

[rirusstek2]

winXP -- Norton Internet Security -- Norton Antivirus....

I keep getting the message "INVALID TPC FLAGS" alerts from the firewall Protector Norton, which blocks them.

This comes up quite often, from diferent pages.

Any idea why this happens???? Or what does it mean?

 

[rwullems]

Hi, don't know how Norton handles all of this, but the common TCP flags is a 6 bit field in the TCP header using the following discriptions:

- Urgent pointer (1 bit)
- Ack bit
- Push bit
- Reset bit
- Syn bit
- Fin bit

There are SIX more bit's in front of these fields, that are currently not used and reserved for future use. for more infor see RFC 0793

If you have the possibility try to capture some frames using a network analyzer like ethereal or paketyzer and check the TCP header to see if something weird is in there.
regards,
robert

Robert A.H. Wullems
Sniffer University Instructor
SCM/CNX/MSCA