Configuring Threshold Values for TCP SYN Packets Globally
Setting threshold values for TCP SYN packets will protect against TCP SYN attack.
Note: The burst-normal value can be from 30 through 16,000,000 packets per second. The burst-max
value can be from 30 through 16,000,000 packets per second. The lockup seconds can
be from 1 through 10,000 seconds.
- Enter the global configuration mode to set the values globally.
- Set the burst-normal and burst-max threshold values for incoming TCP SYN traffic at the router. On the same line, configure the lockup time.
In the example, if incoming TCP SYN traffic exceeds 30 packets per second, excess packets are dropped. If incoming TCP SYN traffic exceeds 100 packets per second, the device drops all TCP SYN packets for the next 300 seconds.
device(config)# configure terminal device(config)# ip tcp burst-normal 30 burst-max 100 lockup 300