There's a lot of references for definitions of "th_flags" to be found, not only on CP's and Nokia's site, but others like Jim Parkers "fixmyfirewall.com" site: http://www.fixmyfirewall.com/fw1/fw-1.0033.html
Message you're seeing (th_flags 12) means that a SYN ACK arrived that didn't match an existing connection (out of state). If your settings for tcp start timeout (Policy/Global Properties/StatefulInspection) are set reasonably (default is 25 seconds), the question to ask is why is the server taking more than 25 seconds to respond to the SYN?
Steinecke, Sven wrote:
Hello Jim, this messages is equivalent to the "Unknown established TCP packet" in fw 4.1. This basically mean the FW has timed out the session and dropped it from its tables. The next packet doesn't belong to any known session so it drops it.
The th_flags 12 in my opinion means that the session gets a Syn Ack.
Regards Sven
-----Urspr�ngliche Nachricht----- Von: Mohr James [mailto:[EMAIL PROTECTED] Gesendet: Dienstag, 20. Juli 2004 15:57 An: [EMAIL PROTECTED] Betreff: [FW-1] "TCP packet out of state" Messages
Hi All!
We have CheckPoint NG with FP 2. We are receiving sqlnet packets on port 1526 (as it should be) but the application (tnsping) is reporting time outs. I checked the reply packets and I see that after about three minutes they are getting dropped with "th_flags 12 message_info TCP packet out of state" in the info field.
The biggest problem is that this is only happening for one node. Other nodes in the same segment can connect fine. I have found a number of references to "TCP packet out of state", but nothing specifically for this problem. I have found nothing to tell me what "th_flags 12" means.
Any help would be greatly appreaciated.
Regards,
Jim Mohr
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
