NSE4 · Question #528
Which TCP states does the global setting `tcp-half-open-timer' applies to? (Choose two.)
The correct answer is A. SYN SENT D. TIME WAIT. The FortiGate global setting tcp-half-open-timer is designed to manage the timeout for TCP sessions that are in a half-open state, specifically applying to SYN_SENT and TIME_WAIT TCP states.
Question
Which TCP states does the global setting `tcp-half-open-timer' applies to? (Choose two.)
Options
- ASYN SENT
- BSYN & SYN/ACK
- CFIN WAIT
- DTIME WAIT
How the community answered
(48 responses)- A88% (42)
- B8% (4)
- C4% (2)
Why each option
The FortiGate global setting `tcp-half-open-timer` is designed to manage the timeout for TCP sessions that are in a half-open state, specifically applying to SYN_SENT and TIME_WAIT TCP states.
The SYN_SENT state indicates a connection where a SYN packet has been sent but no SYN/ACK has been received, which is a classic half-open condition for which a timer is crucial to prevent resource exhaustion.
SYN & SYN/ACK are part of the initial three-way handshake; the `tcp-half-open-timer` targets the client-side SYN_SENT state and server-side SYN_RECV (not listed) states to protect against SYN floods, but not SYN/ACK as a standalone state for half-open resource management.
FIN_WAIT states occur during the graceful closure of a TCP connection and are managed by different timeout settings, not specifically the `tcp-half-open-timer` which focuses on initial connection establishment or specific post-closure scenarios.
The TIME_WAIT state, while typically occurring after connection closure, is also managed by `tcp-half-open-timer` on FortiGates to control resource usage by tracking lingering connections.
Concept tested: TCP half-open timer and states
Source: https://docs.fortinet.com/document/fortigate/7.4.0/cli-reference/169046/config-system-global
Topics
Community Discussion
No community discussion yet for this question.