166 ◾ Network Attacks and Defenses: A Hands-on Approach
Because different OSs respond differently to such
anomalies, the response (or lack of response) from the
targeted device can provide a clue as to the type of OS
it is running.
2. TCP packet with SYN and FIN flags set (T3): Both the
SYN and FIN control flags are not normally set in the
same TCP segment header. The SYN flag synchronizes
sequence numbers to initiate a TCP connection. The FIN
flag indicates the end of data transmission to finish a TCP
connection. Their purposes are mutually exclusive. A TCP
header with the SYN and FIN flags set is anomalous TCP
behavior, causing various responses from the recipient,
depending on the OS.
3. TCP packet with FIN flag and without ACK (T7): Normally ...