Dell PowerConnect B-RX Configuration Manual page 1059

Protecting against a blind TCP reset attack using the SYN bit
In a blind TCP reset attack, a perpetrator attempts to guess the SYN bits to prematurely terminate
an active TCP session.
To prevent a user from using the SYN bit to tear down a TCP connection, the SYN bit is subject to
the following rules when receiving TCP segments:
•
•
•
The TCP security enhancement is enabled by default. To disable it, refer to
security enhancement"
Protecting against a blind injection attack
In a blind TCP injection attack, a perpetrator tries to inject or manipulate data in a TCP connection.
To reduce the chances of a blind injection attack, perform an additional check on all incoming TCP
segments.
This TCP security enhancement is enabled by default. To disable it, refer to
security enhancement"
Disabling the TCP security enhancement
The TCP security enhancement is automatically enabled. If necessary, you can disable this feature.
When you disable this feature, the BigIron RX reverts to the original behavior.
To disable the TCP security enhancement, enter the following command at the Global CONFIG level
of the CLI.
BigIron RX(config)# no ip tcp tcp-security
To re-enable the TCP security enhancement once it has been enabled, enter the following
command.
BigIron RX(config)# ip tcp tcp-security
Syntax: [no] ip tcp tcp-security
BigIron RX Series Configuration Guide
53-1001810-01
If the SYN bit is set and the sequence number is outside the expected window, the device
sends an acknowledgement (ACK) back to the peer.
If the SYN bit is set and the sequence number is an exact match to the next expected
sequence, the device sends an ACK segment to the peer. Before sending the ACK segment, the
software subtracts one from the value being acknowledged.
If the SYN bit is set and the sequence number is acceptable, the device sends an
acknowledgement (ACK) segment to the peer.
on page 987.
on page 987.
Protecting against TCP SYN attacks
"Disabling the TCP
"Disabling the TCP
34
987