Stimulus and Response - TCP - Setting 5 flags

In the 4 previous posts within this series, we looked at setting 1, then 2, then 3 and then 4 flags. In this post we will set 5 flags. So without further ado, let's look at setting 5 flags

URG-ACK-PSH-RST-SYN  -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAPRS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [SYN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.000957    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [SYN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0

From the above:
Windows 2012 - Packet with URG-ACK-PSH-RST-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with URG-ACK-PSH-RST-SYN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.
   
   
URG-ACK-PSH-RST-SYN  -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAPRS"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [SYN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.000961    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [SYN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0

From the above:
Windows 2012 - Packet with URG-ACK-PSH-RST-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with URG-ACK-PSH-RST-SYN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

---------------------------------------------------------------------------   

URG-ACK-PSH-RST-FIN  -> Windows 2012/CentOS 6.5 -> 80 (Listening)   
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="UAPRF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  3  19.183058    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  6  19.189581    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0

From the above:
Windows 2012 - Packet with URG-ACK-PSH-RST-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with URG-ACK-PSH-RST-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


URG-ACK-PSH-RST-FIN  -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="UAPRF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0
  2   0.000903    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, RST, PSH, ACK, URG] Seq=0 Ack=0 Win=8192 Urg=0 Len=0

From the above:
Windows 2012 - Packet with URG-ACK-PSH-RST-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with URG-ACK-PSH-RST-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.


---------------------------------------------------------------------------

ACK-PSH-RST-SYN-FIN  -> Windows 2012/CentOS 6.5 -> 80 (Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=80, flags="APRSF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  4  15.724956    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 80 [FIN, SYN, RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  5  15.726052    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 80 [FIN, SYN, RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0

From the above:
Windows 2012 - Packet with ACK-PSH-RST-SYN-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with ACK-PSH-RST-SYN-FIN flag set, sent to LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.
 

ACK-PSH-RST-SYN-FIN  -> Windows 2012/CentOS 6.5 -> 81 (Non-Listening)
>>> sendp(Ether()/IP(src="10.0.0.50", dst=["10.0.0.100","10.0.0.101"])/TCP(sport=5000, dport=81, flags="APRSF"),iface='eth0', count=1)
..
Sent 2 packets.

root@securitynik:~# tshark -n -i eth0 -Y '((tcp.port==80) or (tcp.port==81))'
  1   0.000000    10.0.0.50 -> 10.0.0.100   TCP 54 5000 > 81 [FIN, SYN, RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
  2   0.000908    10.0.0.50 -> 10.0.0.101   TCP 54 5000 > 81 [FIN, SYN, RST, PSH, ACK] Seq=0 Ack=0 Win=8192 Len=0
 
From the above:
Windows 2012 - Packet with ACK-PSH-RST-SYN-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the Windows 2012 system simply drops the packet.

CentOS 6.5  - Packet with ACK-PSH-RST-SYN-FIN flag set, sent to NON-LISTENING PORT, results in a Silent Discard. That is there is no response from the TCP/IP Stack, the CentOS system simply drops the packet.

If you wish to have this as a reference, you may download:If you wish to have this as a reference, you may download:
"Stimulus and Response.pdf" document.
md5:8c931888caf948504188f57440396ebc
sha-1:c4cb5b06928e660a09ddc7eaf4b7e32fb0dd1a27

stimulus-response.xlsx
MD5:6176b65c89b73e3b07a519bf77db462a
SHA-1:1ff6308e2a56a1c950e4cc5831932d78563bf853