topic Re: ASA PACKET CAPTURE (SWE FLAG) in Network Security

ASA PACKET CAPTURE (SWE FLAG)

sambillings459 — Fri, 21 Feb 2020 15:05:25 GMT

Hi Experts,

I need some help from from you guys.

Today I was doing packet capture on Cisco ASA and during the capture in my logs I saw SWE flag. Can anyone please let me know does it mean

I also tried googling it but didn’t get accurate answers.

Appreciate any quick response.

Re: ASA PACKET CAPTURE (SWE FLAG)

Ajay Saini — Sun, 07 Jan 2018 07:23:10 GMT

Hello,

Can you please attach a portion of logs/captures where you encountered the SWE flag. You can remove sensitive info as required.

Regards,

Re: ASA PACKET CAPTURE (SWE FLAG)

Ajay Saini — Mon, 08 Jan 2018 08:03:47 GMT

Okay, found something and makes sense:

https://forums.gentoo.org/viewtopic-t-509973-start-0.html

-HTH

Re: ASA PACKET CAPTURE (SWE FLAG)

sambillings459 — Mon, 08 Jan 2018 14:11:05 GMT

24: 09:21:11.405984 1.1.1.1.54116 > 2.2.2.2.9100: SWE 4252812793:4252812793(0) win 8192 <mss 1420,nop,wscale 8,nop,nop,sackOK,opt-33:210081c4862157070000>
25: 09:21:14.409280 1.1.1.1.54116 > 2.2.2.2.9100: SWE 4252812793:4252812793(0) win 8192 <mss 1420,nop,wscale 8,nop,nop,sackOK,opt-33:210081c4862157070000>
26: 09:21:17.426094 1.1.1.1.54117 > 2.2.2.2.9100: SWE 2154972116:2154972116(0) win 8192 <mss 1420,nop,wscale 8,nop,nop,sackOK,opt-33:210081c4862157070000>
27: 09:21:20.428429 1.1.1.1.54117 > 2.2.2.2.9100: SWE 2154972116:2154972116(0) win 8192 <mss 1420,nop,wscale 8,nop,nop,sackOK,opt-33:210081c4862157070000>

Re: ASA PACKET CAPTURE (SWE FLAG)

Ajay Saini — Tue, 09 Jan 2018 12:58:03 GMT

Hello,

Please refer to my first response. I found a link that explains the tcp options utilising the SWE flags.

Regards,

Re: ASA PACKET CAPTURE (SWE FLAG)

Rajavethan Veeriah — Thu, 03 Dec 2020 03:16:22 GMT

Hi there,

I found similar SWE Flag when I did packet capture during tshooting.

Turns out, there is another device after this firewall which is blocking the traffic.

So , it seem from the packet capture example above -- only Syn is sent.

Syn/Ack is not coming back from the destination host. Thus resulting to a TCP timeout.

Hope this helps ...

Raj Veeriah

Re: ASA PACKET CAPTURE (SWE FLAG)

Jesse Mijares — Wed, 21 Sep 2022 14:36:39 GMT

@sambillings459 SWE es por que tiene SYN+ECN Echo+ECN Cwnd Reducido, por lo que SYN inicial asi utiliza un "paquete SYN de configuración de ECN". Indica que el host que envía el paquete es compatible con ECN.
"E" tiene SYN+ECN Echo establecido; probablemente también tenga configurado ACK (según el campo "ack" en el paquete), por lo que es una respuesta SYN+ACK al SYN inicial, y es, para usar la terminología en la sección 6.1.1 de RFC 3168, un " Paquete SYN-ACK de configuración ECN". Indica que el host que envía el paquete es compatible con ECN.
El ECN tiene la bondad de una notificación de congestión de extremo a extremo entre dos puntos de conexión en redes basadas en TCP/IP.