ACK,RST Security Issue

SJobs1971 — Fri, 21 Feb 2020 12:23:30 GMT

I did an nmap against myself, in which (with wireshark) I discovered that if nmap sends a TCP ACK out to my router, my router will automatically respond with a TCP RST. Is there anyway to stop the router from sending an RST for a connection that doesn't exist? I already use:

permit tcp any any established

deny ip any any log

But that doesn't seem to work. Any advice would be appreciated.

Essentially what I'm looking to do it to Block TCP reset (RST) on closed TCP ports to prevent TCP port scanning.

Thanks.

ACK,RST Security Issue

Farrukh Haroon — Tue, 19 Jul 2011 14:14:53 GMT

I think there are limitations on IOS in doing this, but the following link will help you block some of these ports:

http://blog.ioshints.info/2007/06/closed-versus-filtered-ports.html

Blocking TCP RST packets might also work, but you would have to look into the various filtering planes (control, data etc)

http://fengnet.com/book/Cisco.IOS.Cookbook.2nd/I_0596527225_CHP_19_SECT_5.html

Regards

Farrukh

topic ACK,RST Security Issue in Network Security

ACK,RST Security Issue

ACK,RST Security Issue