Rule:--Sid:621--Summary:A tcp packet with only it's FIN flag set was detected.--Impact:Information regarding firewall rulesets, open/closed ports, ACLs, andpossibly even OS type may be disclosed.  This technique can also beused to bypass certain firewalls or traffic filtering/shaping devices.--Detailed Information:A tcp packet with only it's FIN flag set was detected.  Most Windowsmachines will respond with an ACK-RST regardless of whether or not theport is open.  Most *nix systems will respond with an ACK-RST if theport is closed and will not respond at all if the port is open.Actual responses may vary.--Affected Systems: --Attack Scenarios:As part of information gathering leading up to another (more directed)attack, an attacker may attempt to figure out what ports areopen/closed on a remote machine.--Ease of Attack:Intermediate.  To initiate an attack of this type, an attacker eitherneeds a tool that can send packets with only the FIN flag set orthe ability to craft their own packets.  The former is easy, the laterrequires a more advanced skillset.--False Positives:None Known--False Negatives:None Known--Corrective Action:Determine if this particular port would have responded as being openor closed.  If open, watch for more attacks on this particular serviceor from the remote machine that sent the packet.  If closed, simplywatch for more traffic from this host.  Consider filtering this typeof traffic at the ingress points of your network.--Contributors:Original rule writer unknownOriginal document author unkownSourcefire Vulnerability Research TeamNigel Houghton <nigel.houghton@sourcefire.com>Jon Hart <warchild@spoofed.org>-- Additional References:--