ip tcp burst-normal

In a TCP SYN attack, an attacker floods a host with TCP SYN packets that have random source IP addresses. For each of these TCP SYN packets, the destination host responds with a SYN ACK packet and adds information to the connection queue. However, because the source host does not exist, no ACK packet is sent back to the destination host, and an entry remains in the connection queue until it ages out (after approximately one minute). If the attacker sends enough TCP SYN packets, the connection queue can fill up, and service can be denied to legitimate TCP connections.

To protect against TCP SYN attacks, you can configure the device to drop TCP SYN packets when excessive packets are encountered. You can set threshold values for TCP SYN packets that are targeted at the router itself or that pass through an interface, and drop them when the thresholds are exceeded.

If the interface is part of a VLAN that has a router VE, you must configure TCP SYN attack protection at the VE level. When TCP SYN attack protection is configured at the VE level, it will apply to routed traffic only. It will not affect switched traffic.

The rate of incoming TCP SYN packets is measured and compared to the threshold values as follows:

• If the number of TCP SYN packets exceeds the burst-normal value, the excess TCP SYN packets are dropped.
• If the number of TCP SYN packets exceeds the burst-max value, all TCP SYN packets are dropped for the number of seconds specified by the lockup value. When the lockup period expires, the burst counter is reset and measurement is restarted.

The no form of the command removes the threshold values set for TCP SYN packets.