Configuring Tcp And Icmp Attack Protection; Overview; Enabling The Syn Cookie Feature - HP 12500 Series Configuration Manual

Configuring TCP and ICMP attack protection

Overview

An attacker can attack the device during the process of TCP connection establishment or by sending a
large number of ICMP fragments. To prevent such attacks, the switch provides the following features:
SYN Cookie
•
Protection against Naptha attacks
•
Disabling of ICMP fragments forwarding
•
This document describes the attacks these features can prevent, working mechanisms of these features,
and configuration procedures.

Enabling the SYN Cookie feature

As a general rule, the establishment of a TCP connection involves the following handshakes:
The request originator sends a SYN message to the target server.
1.
After receiving the SYN message, the target server establishes a TCP connection in
2.
SYN_RECEIVED state, returns a SYN ACK message to the originator, and waits for a response.
After receiving the SYN ACK message, the originator returns an ACK message. Thus, the TCP
3.
connection is established.
Attackers may mount SYN Flood attacks during TCP connection establishment. They send a large number
of SYN messages to the server to establish TCP connections, but they never make any response to SYN
ACK messages. As a result, a large amount of incomplete TCP connections are established, resulting in
heavy resource consumption and making the server unable to handle services normally.
The SYN Cookie feature can prevent SYN Flood attacks. After receiving a TCP connection request, the
server directly returns a SYN ACK message, instead of establishing an incomplete TCP connection. Only
after receiving an ACK message from the client can the server establish a connection, and then enter
ESTABLISHED state. In this way, large amounts of incomplete TCP connections could be avoided to
protect the server against SYN Flood attacks.
To enable the SYN Cookie feature:
Step
1. Enter system view.
2. Enable
feature.
If you enable MD5 authentication for TCP connections, the SYN Cookie configuration is ineffective. Then,
if you disable MD5 authentication for TCP connections, the SYN Cookie configuration automatically
Command
system-view
the SYN Cookie
tcp syn-cookie enable
246
Remarks
N/A
Enabled by default.
With the SYN Cookie feature
enabled, only the MSS, instead of
the window's zoom factor and
timestamp, is negotiated during
TCP connection establishment.