Protecting against TCP SYN Attacks

TCP SYN attacks exploit the process of how TCP connections are established to disrupt normal traffic flow. When a TCP connection starts, the connecting host first sends a TCP SYN packet to the destination host. The destination host responds with a SYN ACK packet, and the connecting host sends back an ACK packet. This process, known as a "TCP three-way handshake," establishes the TCP connection.

While waiting for the connecting host to send an ACK packet, the destination host keeps track of the as-yet incomplete TCP connection in a connection queue. When the ACK packet is received, information about the connection is removed from the connection queue. Usually there is not much time between the destination host sending a SYN ACK packet and the source host sending an ACK packet, so the connection queue clears quickly.

In a TCP SYN attack, an attacker floods a host with TCP SYN packets that have random source IP addresses. For each of these TCP SYN packets, the destination host responds with a SYN ACK packet and adds information to the connection queue. However, because the source host does not exist, no ACK packet is sent back to the destination host, and an entry remains in the connection queue until it ages out (after approximately a minute). If the attacker sends enough TCP SYN packets, the connection queue can fill up, and service can be denied to legitimate TCP connections.

To protect against TCP SYN attacks, you can configure the RUCKUS device to drop TCP SYN packets when excessive numbers are encountered. You can set threshold values for TCP SYN packets that are targeted at the router itself or that pass through an interface, and drop them when the thresholds are exceeded.

Note:
Do the ICX 8100 devices support this command?no
ICX 8200 and ICX 8100 devices do not support the ip tcp attack-rate burst-normal burst-max command. Refer to Defense against TCP Denial of Service Attacks on ICX 8100 and ICX 8200 Devices for information on available TCP DDOS options for ICX 8100 and ICX 8200 devices.

Incoming TCP SYN traffic is measured and compared to the threshold values as follows:

  • If incoming TCP SYN packets exceed the burst-normal value, the excess TCP SYN packets are dropped.
  • If incoming TCP SYN packets exceed the burst-max value, all TCP SYN packets are dropped for the number of seconds specified by the lockup value. When the lockup period expires, the burst counter is reset, and measurement is restarted.

In this section:

  1. Configuring Threshold Values for TCP SYN Packets Globally
    Setting threshold values for TCP SYN packets will protect against TCP SYN attack destined to the switch.
  2. Configuring TCP SYN Threshold Values on an Interface
  3. TCP MSS Adjustment Overview
    TCP MSS adjustment modifies the maximum segment size (MSS) field from the TCP header in the TCP SYN/SYN-ACK packet during a three-way handshake. TCP MSS adjustment applies only to TCP connections that pass through the router. It does not apply to TCP connections originating from or destined to the router.
  4. Example of TCP MSS Adjustment
  5. Impact on Existing Functionality
    The TCP SYN attack feature is affected because of TCP MSS adjustment. Both features look for the same fields in the packet, so either one of the ACL rules can be hit.
  6. TCP MSS Adjustment Limitations
Parent topic: Protecting against Denial of Service Attacks