What are Null Flood and Christmas Tree Scan; why does TR7 block these packets without false positive risk?

Short answer

TCP packets report the state of the connection with the FIN, SYN, RST, PSH, ACK and URG flags (RFC 9293). Null Flood refers to TCP packets on which no flag is marked; Christmas Tree Scan, on the other hand, marks mutually incompatible flags at the same time (its classic form is FIN, PSH and URG; Nmap); scanner tools produce these to probe firewall behavior and to guess the operating system of the remote system. Since a legitimate TCP stack never produces these combinations, a caught packet has no legitimate counterpart; for this reason, the rules require neither a threshold nor learning and carry no false positive risk. In TR7, on the L4 DDoS Management screen of the route table, the Malformed Flags & Scans box in the TCP band contains the Null Flood rule, the Christmas Tree Scan rule that catches the packet with all flags marked, and the Bogus TCP Flags rule that catches twelve invalid flag patterns including the FIN+PSH+URG combination; the default value of all three is Block, and the source can also be taken into quarantine.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → TCP → Malformed Flags & Scans box	Null Flood, Christmas Tree Scan, Bogus TCP Flags: Status (Disabled · Monitor · Block · Quarantine)	Monitoring or dropping packets with invalid flag combinations, or taking the source into quarantine
Route table Dashboard → Suspicious Packets	The packet class panel per rule (measurement and dashboard)	Monitoring the number of caught packets

• The fourth rule in the same box, Port Scan, looks not at the form of the packet but at the behavior of the source: What is a Port Scan; how does TR7 detect a source performing a port scan?
• The four rules of the box are exempt from the Mode Promotion permission of the learning engine: they can receive a recommendation to move from Monitor to Block even while the permission is off (why).
• The change is applied as soon as it is saved with Save; the rules are set separately for each route table. The sources in the exemption list are not caught by these rules.

Common Misconceptions

• "These rules can also drop legitimate traffic." Legitimate TCP does not produce these flag combinations; this is why the rules have no threshold and carry no false positive risk.
• "Null Flood is a volume attack." Although its name says flood, the rule looks at the form of each individual packet; the first packet is a violation, and the rule does not wait for a rate threshold.
• "SYN Flood: Not-SYN and SYN Flood: Bad MSS are just as definite." These two rules are signature checks too, but a healthy network (asymmetric routing, some intermediate devices) can produce these packets; for this reason, they are subject to the Mode Promotion permission.

How it is done in the documentation

• Malformed Flags & Scans · Null Flood
• Malformed Flags & Scans · Christmas Tree Scan
• Malformed Flags & Scans · Bogus TCP Flags
• Malformed Flags & Scans · Scope and Limits

Related questions

• What is a Port Scan; how does TR7 detect a source performing a port scan?
• What is a SYN Flood attack; which rules does TR7 apply against it?
• What are SYN Cookies; when do they come into play in TR7?