Re: Checkpoint rule 0 "unknown est. tcp connection" drops

[Lance Spitzner <lance () honeynet org>]

On Tue, 7 Aug 2001 black () galaxy silvren com wrote:

> Preamble:
>
> I checked phoneboy's site and also checkpoint, the only solution was to
> simply disable the syn rulebase matching, which I eventually did and it
> did in fact take care of the problem. However, I think that the syn
> rulebase matching in general is seriously broken.
>
> Here are the details:

I wrote a detailed paper on FW-1 state table.  If you have not yet,
you may want to review the paper as it offers detailed information into
CheckPoint state management.

     http://www.enteract.com/~lspitz/fwtable.html

lance

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards