D-Link NetDefend DFL-210 User Manual page 261

TCPRF
Specifies how NetDefendOS will deal with TCP packets with either the Xmas or Ymas flag turned
on. These flags are currently mostly used by OS Fingerprinting.
Note: an upcoming standard called Explicit Congestion Notification also makes use of these TCP
flags, but as long as there are only a few operating systems supporting this standard, the flags should
be stripped.
Default: StripLog
TCPRF
Specifies how NetDefendOS will deal with information present in the "reserved field" in the TCP
header, which should normally be 0. This field is not the same as the Xmas and Ymas flags. Used
by OS Fingerprinting.
Default: DropLog
TCPNULL
Specifies how NetDefendOS will deal with TCP packets that do not have any of the SYN, ACK,
FIN or RST flags turned on. According to the TCP standard, such packets are illegal and are used by
both OS Fingerprinting and stealth port scanners, as some firewalls are unable to detect them.
Default: DropLog
248
Chapter 13. Advanced Settings