> Source: [sk36869](https://support.checkpoint.com/results/sk/sk36869)

# sk36869 - "TCP segment with urgent pointer. Urgent data indication was stripped. Please refer to sk36869." log in SmartConsole / SmartView

| Property | Value |
|----------|-------|
| Solution ID | sk36869 |
| Date Created | 2009-01-05 |
| Last Modified | 2025-04-23 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81.10.X, R81 (EOS) |
| OS | Gaia |

## Symptoms

- * "`TCP segment with urgent pointer. Urgent data indication was stripped. Please refer to sk36869.`" log in SmartConsole / SmartView / SmartView Tracker / SmartLog.

* "`TCP segment with urgent pointer (no data). Urgent data indication was stripped. Please refer to sk36869.`" log in SmartConsole / SmartView / SmartView Tracker / SmartLog.

## Cause

The default behavior for dealing with urgent data on all TCP ports (except for ports 21 (FTP), port23 (TELNET) and 513 (RLOGIN)) is to strip the "[URG](https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure)" flag from the TCP packet.

However, a user may need to create an exception to drop the TCP packet with an "URG" flag, or an exception to not strip the "URG" flag from the TCP packet.

## Solution

### Background

Removing the "[URG](https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure)" flag from TCP packets that do not contain data should not affect a connection.

Therefore, if the log indicates that the "urgent" flag was stripped from a TCP packet that does not contain data, then no action is necessary.

If the TCP packet contains data, it still does not necessarily indicate a problem. No action is necessary unless you are experiencing a connectivity problem for the logged connection.

### Procedure for Security Gateways running the Gaia OS

To add the connection's service to the list of services, for which "urgent" data is allowed, define a kernel table named "`tcp_urgent_ports_user`" in the relevant *user.def* file on the Security Management Server / Domain Management Server and add the applicable action for the service's port.

The locations of the *user.def* files are listed in [sk98239 - Location of 'user.def' files on Security Management Server](https://support.checkpoint.com/results/sk/sk98239)).

Syntax in the "user.def" file:

`tcp_urgent_ports_user={<TCP_DESTINATION_PORT_1;ACTION_1>, <TCP_DESTINATION_PORT_2;ACTION_2>, ..., <TCP_DESTINATION_PORT_N;ACTION_N>};`

These actions are supported for TCP packets with the "urgent" flag that are sent to the specified destination port:

|----------------------|-------------------------------------------------------------------------------------------|
| Action               | Description                                                                               |
| `URGENT_DATA_STRIP`  | Strips the "urgent" flag from the TCP packets with the specified destination port         |
| `URGENT_DATA_INLINE` | Does not strip the "urgent" flag from the TCP packets with the specified destination port |
| `URGENT_DATA_RESET`  | Rejects TCP packets with the "urgent" flag and with the specified destination port        |

**Important Notes:**

* Do **not** add a service as "`_URGENT_DATA_INLINE`", unless you verified that this service indeed supports the TCP "urgent" data functionality.  
  If you configure the Security Gateway to accept urgent data on TCP services that do not support the "urgent" functionality, then the connections that match will bypass all IPS protections.

* You must enable the IPS Software Blade on this Security Gateway before changing the behavior for dealing with "urgent" data using the *user.def* file.

Example 1:
> Do not strip the "URG" flag from TCP packets with the Destination Port 514 (RemoteShell):
>
> `tcp_urgent_ports_user={<514;URGENT_DATA_INLINE>};`

Example 2:
> * Do not strip the "URG" flag from TCP packets with the Destination Port 80
> * Strip the "URG" flag from TCP packets with the Destination Port 8080
> * Reject TCP packets with the "URG" flag and with the Destination Port 514
>
> `tcp_urgent_ports_user={<80;URGENT_DATA_INLINE>, <8080;URGENT_DATA_STRIP>, <514;URGENT_DATA_RESET>};`

### Procedure for Locally Managed Quantum Spark Gateways running the Gaia Embedded OS

**Important Note** - We do not recommend this procedure because it decreases your security.

1. Connect to the WebUI on the Quantum Spark Gateway.

2. On the left navigation panel, click the "**Device**" view.

3. In the "**Advanced** " section, click the "**Advanced Settings**" page.

4. In the top right field, search for "**Streaming engine settings - TCP urgent data enforcement action**".

5. In the row "**TCP urgent data enforcement action** ", change the action from "**Prevent** " to "**Detect**".

6. Click "**Save**".

### Related Solutions

* [sk98239 - Location of 'user.def' file on Management Server](https://support.checkpoint.com/results/sk/sk98239)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content