TCP Packet out of state

[sridharraj80]

Hey Techies,

Today for plenty of times we were not able to take control of few servers which is in DMZ even though proper rule is available . When I was going through in log in smartview tracker i see

TCP Packet out of state : First packet isn't SYN tcp_flags :FIN-ACK &
TCP Packet out of state : First packet isn't SYN tcp_flags :FIN-PUSH-ACK

What could be the possible cause of this.

Expecting reply ...
Sridhar

[cmarcusson]

Three things to test here, shut off your SmartDefense and increase your TCP timeout settings in Global Properties. I've seen this problem been caused by both of these things before. If TCP times out then it will drop the state, and when the reply finally gets there it will be out of sync. Also SmartDefense is capable of interfearing with the TCP handshake and not even logging anything, even if it is set to log. The last thing would be to check if the SAM rules are blocking something.

[woody]

You can also change the Golbal Properties to not check for out-of-state TCP packets. However, the first thing I'd look at is the server and app responding back before turning off features in Checkpoint.

[MarioL]

While you can disable the Drop out-of-state TCP packets, please be aware that it really isn't a good idea. At most consider that a VERY temporary work-around if this is critical.

Has anything been changed on the policy? Can there be any funny routing that is making packets go different routes?

[lodown]

Is this known valid traffic being dropped?

lodown