L4 Xmas

TCP Xmas flood

Classic Xmas scan style: FIN, PSH, and URG flags set together (FPU). Probes how filters classify “lit up” Christmas tree packets at high PPS.

How it works

  1. Engarde Xmas Flood preset uses TCP flag FPU with invalid_flag=true.
  2. Historically used in port scanning; at flood rates it stresses parse and classify logic.
  3. Distinct from ALL TCP Flags (FPU without invalid_flag) — compare both presets.
  4. Often dropped by modern stacks; simulation confirms your path behavior.

Packet flow (illustrative)

TCP segments with FIN + PSH + URG (Xmas / FPU).

Illustrative flow — not a live capture.

Flags F + P + U (FPU)
Engarde Xmas Flood
invalid_flag true

What to watch in Engarde

  • Drop vs. forward ratio on each hop.
  • IDS rules referencing Xmas or FPU patterns.

Running this simulation

Run Xmas Flood preset on lab target; pair with ALL TCP Flags preset report for contrast.

Mitigation perspective

Explicit deny for Xmas/FPU combos on edge; document exceptions for legacy apps if any.