Enabling Protection Against Naptha Attack - 3Com MSR 50 Series Configuration Manual

634 C 41: IP P
HAPTER ERFORMANCE
n
Enabling Protection
Against Naptha Attack
C
ONFIGURATION
a large amount of TCP semi-connections are established, resulting in heavy
resource consumption and making the server unable to handle services normally.
The SYN Cookie feature can prevent SYN Flood attacks. After receiving a TCP
connection request, the server directly returns a SYN ACK message, instead of
establishing a TCP semi-connection. Only after receiving an ACK message from
the client can the server establish a connection, and then enter the ESTABLISHED
state. In this way, large amounts of TCP semi-connections could be avoided to
prevent the server from SYN Flood attacks.
Follow these steps to enable the SYN Cookie feature:
To do...
Enter system view
Enable the SYN Cookie
feature
If the MD5 authentication is enabled, the SYN Cookie feature will not function.
■
After the MD5 authentication is disabled, the configured SYN Cookie feature
will be enabled automatically.
With the SYN Cookie feature enabled, only the MSS, instead of the window's
■
zoom factor and timestamp, is negotiated during TCP connection
establishment.
Naptha attacks are similar to the SYN Flood attacks. Attackers can perform Naptha
attacks by using the six TCP connection states (CLOSING, ESTABLISHED,
FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, and SYN_RECEIVED), and SYN Flood
attacks by using only the SYN_RECEIVED state.
Naptha attackers control a huge amount of hosts to establish TCP connections
with the server, keep these connections in the same state (any of the six), and
request for no data so as to exhaust the memory resource of the server. As a result,
the server cannot process normal services.
The protection against Naptha attack reduces the risk of the server being attacked
by accelerating the aging of TCP connections in a state. After the protection
against Naptha attack is enabled, the device periodically checks the number of
TCP connections in each state. If it detects that the number of TCP connections in
a state exceeds the maximum number, it will accelerate the aging of TCP
connections in such a state.
Follow these steps to enable the protection against Naptha attack
To do...
Enter system view
Enable the protection against
Naptha attack
Use the command...
system-view
tcp syn-cookie enable
Use the command...
system-view
tcp anti-naptha enable
Remarks
-
Required
Disabled by default.
Remarks
-
Required
Disabled by default.