Security implications of packets with an invalid state (iptables)

Question

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m state --state NEW, ESTABLISHED, RELATED at all. However, seeking for information I found that there is a fourth state:

INVALID:

A packet which could not be identified for some reason: this includes running out of memory and ICMP errors which don't correspond to any known connection. Generally these packets should be dropped.

I'm wondering whether or not packets with such state are harmful from a security perspective. According to that quote, they should be dropped, but the document didn't explain why.

Answer 1

The main reason those invalid packets must be dropped is because they are often used for OS fingerprinting.

As each of the major OSes respond to those packets in different ways, it's easy to find that you are running Linux if you don't drop them.