In this simulation, you will analyze network traffic anomalies. You will learn to identify impossible TCP flag combinations used by attackers to bypass filters and how to craft Wireshark filters to detect them.

CND (312-38) Network Defense Simulation

Network Scenario

The Security Operations Center (SOC) has received alerts from the edge firewall indicating state-table exhaustion. Concurrently, the web servers in the DMZ are dropping unusual packets. You are tasked with analyzing a packet capture (PCAP) to identify the attack signature.

The network topology includes:

Traffic & Logs

Review the following Wireshark capture snippet exported from the DMZ span port:

No. Time Source Destination Protocol Length Info 12 0.012400 198.51.100.22 172.16.0.80 TCP 54 51342 → 80 [SYN, FIN] Seq=0 Win=2048 Len=0 13 0.013210 198.51.100.22 172.16.0.80 TCP 54 51343 → 80 [SYN, FIN] Seq=0 Win=2048 Len=0 14 0.014550 198.51.100.22 172.16.0.80 TCP 54 51344 → 80 [SYN, FIN] Seq=0 Win=2048 Len=0 15 0.015900 198.51.100.22 172.16.0.80 TCP 54 51345 → 80 [SYN, FIN] Seq=0 Win=2048 Len=0

Note: The packet info shows an invalid combination of TCP flags. The attacker is violating RFC 793 to elicit a response or bypass filters.

Question

Which among the following filter is used to detect a SYN/FIN attack?

A. tcp.flags==0x002
B. tcp.flags==0x004
C. tcp.flags==0x001
D. tcp.flags==0x003

Expert Analysis

1. What is happening in the network: The packet capture clearly shows a flood of TCP packets originating from the attacker, targeting port 80. Crucially, each packet has both the SYN (Synchronize) and FIN (Finish) flags set simultaneously.

2. Identify attack or behavior: This is a SYN/FIN scan or attack. According to RFC 793, a packet cannot initiate a connection (SYN) and tear it down (FIN) at the exact same time. Attackers use this malformed packet to bypass older, stateless firewalls or to fingerprint the target operating system based on how it responds to illegal flag combinations.

3. Why correct answer is correct: TCP flags are calculated using hex values. The FIN flag has a value of 1 (0x01). The SYN flag has a value of 2 (0x02). When both are set, you add the values together: 1 + 2 = 3. Therefore, the Wireshark filter tcp.flags==0x003 isolates packets where exactly and only the SYN and FIN flags are set.

4. Why others are wrong:

  • A. tcp.flags==0x002: Filters for packets with ONLY the SYN flag set (normal connection initiation).
  • B. tcp.flags==0x004: Filters for packets with ONLY the RST (Reset) flag set (normal connection termination/refusal).
  • C. tcp.flags==0x001: Filters for packets with ONLY the FIN flag set (normal connection teardown).

5. Defensive action: A modern stateful inspection firewall will automatically drop SYN/FIN packets because they do not conform to valid TCP state transitions. If you are using an IDS/IPS like Snort, ensure the preprocessor is configured to alert on anomalous TCP flag combinations.

Mini Lesson TCP Flag Hex Calculation

When analyzing traffic in Wireshark, understanding the binary/hex mapping of TCP flags is critical for network defenders:

  • 0x20 : URG (Urgent)
  • 0x10 : ACK (Acknowledgment)
  • 0x08 : PSH (Push)
  • 0x04 : RST (Reset)
  • 0x02 : SYN (Synchronize)
  • 0x01 : FIN (Finish)

To detect multiple flags, sum their hex values. For example, a SYN/ACK packet is 0x12 (0x10 + 0x02). A SYN/FIN is 0x03 (0x02 + 0x01).

Explore more CND simulations