A FIN packet is used to terminate a conversation. So to open a conversation the node starting the conversation sends a SYN packet, server responds with SYN-ACK, client responds ACK (the 3-way handshake). To terminate a conversation we send a FIN, server responds with an ACK - at the absolute minimum (actually at most it is a 4-way handshake).
A FIN packet may be used to footprint the services running on the box. If you send a FIN packet to a port where something is listening (say a web server for example), the server must respond with a RST (reset) packet as there appears to be a conversation of which we have not had the start (3-way handshake). This means there is something listening on that port - hence footprinting. More detail can be found on wikipedia and insecure.org (a.k.a. nmap).
The quick thing to do is to stop the host from sending those FIN packets. If the log entries point to the physical internal NIC being responsible it's most likely that a host internally has been compromised. If the logs indicate the packets are originating from outside, take it up with your ISP (ISP's generally don't approve of vigilante activity on their networks).
Hope this helps.
Main Topics
Browse All Topics
by: QuoriPosted on 2009-08-19 at 14:36:59ID: 25137628
FIN flood A network entity sends packets with FIN flag bit set and possibly a spoofed return address. Server replies with FIN-ACK to the spoofed address and then attempts to disconnect the non existent session.