Explain URGP - Firewall log

For Developers
1

Using OpenWrt 23.05.5
Noted something today in logs: URGP=1280? I have never seen this before.

SRC=bad DST=HIDDEN LEN=40 TOS=0x00 PREC=0x00 TTL=119 ID=14139 PROTO=TCP SPT=9987 DPT=31837 WINDOW=0 RES=0x00 ACK SYN URGP=1280
2

It is an obsolete TCP feature called the "urgent pointer." It was used in the past by telnet.

However, in a SYN ACK packet, it serves no purpose besides trying to confuse (i.e., attacking) some vulnerable systems (not your router).

1 Like
3

Can you provide start of log line?
And ubus call system board
By flag combo alone it is invalid for conntrack.

1 Like
4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.