topic Firewall capture in Network Security

Firewall capture

Visauk47 — Mon, 02 Sep 2019 03:34:50 GMT

Hi All,

Just want to know, whats the following firewall capture means ?

win2300 <mss 1460,nop,wscale0,nop,nop,sackok)

Regards,

Vishal

Re: Firewall capture

Dinesh Moudgil — Mon, 02 Sep 2019 04:02:04 GMT

Hi Vishal,

This represents a SYN packet. In a normal 3 way handshake, you would see the following messages:

134: 21:28:12.577637 173.39.68.116.56946 > 10.106.71.184.4443: S 1267690439:1267690439(0) win 65535 <mss 1380,nop,wscale 6,nop,nop,timestamp 1215630636 0,sackOK,eol>
135: 21:28:12.577805 10.106.71.184.4443 > 173.39.68.116.56946: S 1135917460:1135917460(0) ack 1267690440 win 32768 <mss 1380,nop,nop,timestamp 4398415 1215630636>
138: 21:28:12.580322 173.39.68.116.56946 > 10.106.71.184.4443: . ack 1135917461 win 65535 <nop,nop,timestamp 1215630638 4398415>

Regards,

Dinesh Moudgil

P.S. Please rate helpful posts.

Re: Firewall capture

Visauk47 — Tue, 03 Sep 2019 19:54:33 GMT

Hi Dinesh,

Thank you for the reply.

Could you please confirm, what does mss, nop,wscale sackok means ?

Regards,

Vishal

Re: Firewall capture

Dinesh Moudgil — Wed, 04 Sep 2019 00:14:58 GMT

Vishal,

These are general networking terms and fundamentals, not just specific to ASA.
https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-parameters-1

Regards,

Dinesh Moudgil

P.S. Please rate helpful posts.

Re: Firewall capture

Visauk47 — Wed, 04 Sep 2019 01:05:47 GMT

Thanks Dinesh.