> Source: [sk11088](https://support.checkpoint.com/results/sk/sk11088)

# sk11088 - Multiple logs for dropped "TCP out of state" packets are displayed

| Property | Value |
|----------|-------|
| Solution ID | sk11088 |
| Date Created | 2002-04-09 |
| Last Modified | 2026-07-15 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * SmartView Tracker may show multiple logs for TCP packets being dropped as "TCP out of state" packets with the following TCP flag:  
  * `SYN packet for established connection`
* "First packet isn't SYN" drop logs in SmartView Tracker for TCP traffic.

## Cause

Some applications do not maintain proper TCP state.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R81.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173903)
* [Jumbo Hotfix Accumulator for R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175186) starting from Take 14
* [R81.10.00 for Quantum Spark Appliances](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179004)
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 51
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 150
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 241
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 208

<br />

If you choose not to upgrade, it is possible to write a special INSPECT function that will enable specific scenarios and conditions to allow TCP connections to pass through the Security Gateway bypassing the "*Stateful Inspection*" (Out of state) mechanism.

Bypassing this mechanism for specific scenarios means that non-synchronized packets that do not belong to an established connection in the Security Gateway's connections table OR non-TCP compliant traffic will not be dropped, but instead matched against the Security Policy (Rule base).

**Table of Contents:**

* Procedure
* Examples
* Notes
* Related solutions

### Procedure using INSPECT function {#Procedure}

To enforce the workaround, perform these steps:

1. Connect to CLI on the Security Management Server / Multi-Domain Security Management Server that manages this Security Gateway.

   **Note:** In a Management High Availability configuration, you must manually edit / copy the *user.def* file from the active Management Server to all standby Management Servers because *user.def* files are not included in Management High Availability synchronization.
2. Log in to the Expert mode.

3. For the exact location and the name of the relevant "***user.def***" file:

   * For versions R81 and higher:

     See the [Security Management Administration Guide](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=documents&product=184) and the [Multi-Domain Security Management Administration Guide](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=documents&product=166) for your version.
   * For versions R80.40 and lower:

     Refer to [sk98239 - Location of 'user.def' file on Management Server](http://supportcontent.checkpoint.com/solutions?id=sk98239).
4. Back up the relevant "*user.def*" file.

5. Edit the relevant it in Vi editor.

   The following standard INSPECT syntax should be used (refer to "Examples" section below):

   |--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
   | INSPECT function / operator          | Description                                                                                                                                                                       |
   | ***deffunc***                        | reserved word for defining a function                                                                                                                                             |
   | ***user_accept_non_syn() { ... };*** | name of the relevant function to bypass the "*Stateful Inspection*" (Out of state) mechanism                                                                                      |
   | ***ip_p***                           | specifies IP protocol                                                                                                                                                             |
   | ***src***                            | specifies Source IP                                                                                                                                                               |
   | ***dst***                            | specifies Destination IP                                                                                                                                                          |
   | ***sport***                          | specifies Source port There is no way to configure Port Range in the the Source Port '*sport* '. To set port range , set multiple Source Ports (multiple '*sport*')               |
   | ***dport***                          | specifies Destination port There is no way to configure Port Range in the the Destination Port '*dport* '. To set port range, set multiple Destination Ports (multiple '*dport*') |
   | ***th_sport***                       | specifies TCP Source port                                                                                                                                                         |
   | ***th_dport***                       | specifies TCP Destination port                                                                                                                                                    |
   | ***uh_sport***                       | specifies UDP Source port                                                                                                                                                         |
   | ***uh_dport***                       | specifies UDP Destination port                                                                                                                                                    |
   | ***not***                            | logical NOT between filters                                                                                                                                                       |
   | ***and***                            | logical AND between filters                                                                                                                                                       |
   | ***or***                             | logical OR between filters                                                                                                                                                        |
   | ***xor***                            | logical XOR between filters                                                                                                                                                       |

6. Save changes and exit the editor.

7. Install security policy onto Security Gateway.

### Examples for IPv4 {#Examples}

**Notes:**

* Each ***deffunc*** line must end with semi-colon (;).
* For additional syntax examples, refer to [sk30583 - What is FW Monitor?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk30583#Capture Examples) - section "*Capture Examples*".
* On Security Management Server / Multi-Domain Security Management Server ***R76 and above*** , change in the relevant "*user.def* " file:  

  |---------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | From                                                                                        | To                                                                                                                                                                                                                                                                                             |
  | ``` #ifndef __user_def__ #define __user_def__ // // User defined INSPECT code // #endif ``` | ``` #ifndef __user_def__ #define __user_def__ #ifndef IPV6_FLAVOR // // User defined INSPECT code // /* Start of INSPECT modification - sk11088 */ <Your INSPECT function / operators>; /* End of INSPECT modification */ #endif /* ifndef IPV6_FLAVOR */ #endif /* ifndef __user_def__ */ ``` |

  Without this change, the policy installation will fail with:
  > *ERROR: syntax error*   
  > *Error compiling IPv6 flavor*

**Examples:**

1. **Allowing Destination IP address x.x.x.x and Source IP address y.y.y.y, and vice versa**

   The following code should be added to the relevant "*user.def*" file:
   :   

       ```
       #ifndef __user_def__
       #define __user_def__
       #ifndef IPV6_FLAVOR
       
       //
       // User defined INSPECT code
       //
       
       /* Start of INSPECT modification - sk11088 */
       deffunc user_accept_non_syn() { ((dst = x.x.x.x) and (src = y.y.y.y)) or ((dst = y.y.y.y) and (src = x.x.x.x)) };
       /* End of INSPECT modification */
       
       #endif /* ifndef IPV6_FLAVOR */
       #endif /* ifndef __user_def__ */
       ```


2. **Allowing Telnet service on port 23**

   The following code should be added to the relevant "*user.def*" file:
   :   

       ```
       #ifndef __user_def__
       #define __user_def__
       #ifndef IPV6_FLAVOR
       
       //
       // User defined INSPECT code
       //
       
       /* Start of INSPECT modification - sk11088 */
       deffunc user_accept_non_syn() { dport = 23 };
       /* End of INSPECT modification */
       
       #endif /* ifndef IPV6_FLAVOR */
       #endif /* ifndef __user_def__ */
       ```


3. **Allowing Destination IP address x.x.x.x and Source IP address y.y.y.y, and vice versa, AND allowing Telnet service on port 23**

   The following code should be added to the relevant "*user.def*" file:
   :   

       ```
       #ifndef __user_def__
       #define __user_def__
       #ifndef IPV6_FLAVOR
       
       //
       // User defined INSPECT code
       //
       
       /* Start of INSPECT modification - sk11088 */
       deffunc user_accept_non_syn() { (((dst = x.x.x.x) and (src = y.y.y.y)) or ((dst = y.y.y.y) and (src = x.x.x.x))) and (dport = 23) };
       /* End of INSPECT modification */
       
       #endif /* ifndef IPV6_FLAVOR */
       #endif /* ifndef __user_def__ */
       ```


4. **Applying user INSPECT code to whole subnet**

   In this example, we work with subnet *172.30.1.0 / 24*.

   The following code should be added to the relevant "*user.def*" file:
   :   

       ```
       #ifndef __user_def__
       #define __user_def__
       #ifndef IPV6_FLAVOR
       
       //
       // User defined INSPECT code
       //
       
       /* Start of INSPECT modification - sk11088 */
       troublenet={ <172.30.1.0, 172.30.1.255> }; deffunc user_accept_non_syn() { (src in troublenet) };
       /* End of INSPECT modification */
       
       #endif /* ifndef IPV6_FLAVOR */
       #endif /* ifndef __user_def__ */
       ```


   Where "*troublenet* " is the network involved. Use "***and*** " / "***or***" operators to chain additional conditions.
5. **Adding multiple subnets to allow out of state packets**

   In this example, we work with subnet *172.30.1.0 / 24* and with subnet *172.30.20.0 / 24*.

   The following code should be added to the relevant "*user.def*" file:
   :   

       ```
       #ifndef __user_def__
       #define __user_def__
       #ifndef IPV6_FLAVOR
       
       //
       // User defined INSPECT code
       //
       
       /* Start of INSPECT modification - sk11088 */
       troublenet1={ <172.30.1.0, 172.30.1.255> };
       troublenet2={ <172.30.20.0, 172.30.20.255> }; deffunc user_accept_non_syn() {((src in troublenet1) or (src in troublenet2)) };
       /* End of INSPECT modification */
       
       #endif /* ifndef IPV6_FLAVOR */
       #endif /* ifndef __user_def__ */
       ```


### Notes {#Notes}

1. In case there was a mistake in the syntax, policy compilation will fail, and policy will not be installed. The error message will show the exact file and the line where a mistake was made in the syntax.

2. Changes to *\*.def* files are relevant for a specific version/release, and are not supported with other releases.

3. All changes to *\*.def* files will be overwritten when upgrading to a new feature pack / service pack / version. Therefore, before the upgrade, these files should be backed up. After the upgrade, all the changes have to be made again manually. Do not copy the old files over the new ones, because the syntax and the contents change between the versions.

4. If administrator added the Security Gateway to the exclusion list, and there is no IPv6 traffic, then administrator can enable the global kernel parameter ***fw_allow_out_of_state_tcp***:

   1. Enable on-the-fly:  
      *\[Expert@HostName\]# fw6 ctl set int fw_allow_out_of_state_tcp 1*
   2. Verify that this parameter has the value "1":  
      *\[Expert@HostName\]# fw6 ctl get int fw_allow_out_of_state_tcp*
   3. Then, "TCP out of state" should work for IPv6 traffic as well, without needing to configure the *user.def* file.
5. **Important Note for IPv6:**

   The INSPECT code examples for IPv4 above will fail to compile (and install policy).

   For instance, the following code cannot be compiled in IPv6 flavor because the IP addresses 1.1.1.1 and 2.2.2.2 are IPv4 addresses:
   :   

       ```
       deffunc user_accept_non_syn() {
       ((dst = 1.1.1.1) and (src = 2.2.2.2)) or ((dst = 2.2.2.2) and (src = 1.1.1.1))
       };
       ```


   This should be modified to contain rules for IPv4 and for IPv6:
   * IPv4 only rules

     ```
     #ifndef IPV6_FLAVOR
     deffunc user_accept_non_syn() {
     ((dst = 1.1.1.1) and (src = 2.2.2.2)) or ((dst = 2.2.2.2) and (src = 1.1.1.1))
     };
     #endif /* ifndef IPV6_FLAVOR */
     ```

   * IPv6 only rules

     ```
     #ifdef IPV6_FLAVOR
     deffunc user_accept_non_syn() {
     (src = 2001:0db8:85a3:0000:0000:8a2e:0370:7334)
     };
     #endif /* ifndef IPV6_FLAVOR */
     ```

   * IPv4 and IPv6 rules

     ```
     deffunc user_accept_non_syn() {
     #ifdef IPV6_FLAVOR
     /* IPv6 stuff here */
     (src = 2001:0db8:85a3:0000:0000:8a2e:0370:7334)
     #else
     /*IPv4 stuff here*/
     0
     #endif /* ifndef IPV6_FLAVOR */
     };
     ```

   <br />

   The "0" makes the function return, thus "*user_accept_non_syn()*" function does not get to its end, and will not accept the connection.

### Related solutions: {#Related solutions}

* [sk98239 - Location of 'user.def' file on Management Server](http://supportcontent.checkpoint.com/solutions?id=sk98239)
* [sk36161 - Unexpected post SYN packet message in SmartView Tracker](http://supportcontent.checkpoint.com/solutions?id=sk36161)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content