Short question - can it be done? Now, I know what "incomplete" entries are in the log - they are failed 3-way handshakes, or ones that completed with no additional data. The problem is that "incomplete" is not an application or vulnerability that I can select and apply to rules in order to drop it. Now, I realize I could get rid of it by crafting a more specific rule that does not simply pass "any" service, but uses Application defaults. The reason I don't do that is that I work at a university, and it is university mandate (as with many public institutions) to block and/or censor as little of the Internet as possible. Basically unless it's a known bad thing, I'm not allowed to block it. That said, being able to define "incomplete" as a vulnerability and set it up like some of the Brute Force attacks (SSH, for example) would be greatly beneficial. I could then set a threshold for how many of these I would permit before putting the offending external IP into quarantine. Is there a way to do this?
... View more
