Importance of Stateful Firewalls. . .

It was the "Attack Plugin" that was reporting such packets (sent down an open connection) as xmas scan/SYN RST packets as connection attempts. A packet sent with all flags set, was intercepted by the "Attack plugin" as a "Rst attack".
As these intercepted packet where part of an already established connection, then the SPI is not filtering these, it is the "Attack Plugin"

 

I think the plugin will block all incoming packets with the Syn flag as connection attempts and any with the Rst flag as a "Rst Attack" so it wouldn't identify Kamikaze/Xmas packets (all flags set) specifically.

Obviously, this plugin does need to be disabled (or at least, trimmed down in the type of attacks detected) if you wish to run a server of any description (including most filesharing applications).

 

I was just trying to work out why, from an already established connection that the "Attack Plugin" was intercepting these. It does look like all packets are passed through this Plugin before being passed to the SPI.

 

So does that mean that SPI is only really essential on TCP protocol, and that SPI on UDP and ICMP is 'largely irrelevant for personal users'? And by 'largely irrelevant for personal users,' do you mean it provides little or no additional security protection for personal users?

So virtually all software firewalls have at least basic SPI?

Also, does the varying implementations of SPI by firewalls, even when considering just basic SPI, potentially render one more effective and secure than another?

 

Because (a) the plugins work independently from the rules engine (i.e. Attack Detection has no knowledge of what packets belong to established connections) and (b) as you note, plugins get to process packets before the rules engine (covered in the Outpost Rules Processing Order FAQ).

In this case though, the results are beneficial - an attack is an attack regardless of whether it uses an established connection or not.

 

Well as we are talking of SPI, and not plugins, I will try later with the plugin removed, so I will be checking the SPI engine.