Enabling Protection Against Naptha Attacks - HP 12500 Series Configuration Manual

becomes effective. For more information about MD5 authentication, see Layer 3—IP Routing
Configuration Guide.

Enabling protection against Naptha attacks

Naptha attacks are similar to the SYN Flood attacks. Attackers can perform Naptha attacks by using the
six TCP connection states (CLOSING, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, and
SYN_RECEIVED), and SYN Flood attacks by using only SYN_RECEIVED state.
Naptha attackers control a huge amount of hosts to establish TCP connections with the server, keep these
connections in the same state (any of the six), and request for no data so as to exhaust the memory
resource of the server. As a result, the server cannot process normal services.
Protection against Naptha attacks reduces the risk of such attacks by accelerating the aging of TCP
connections in a state. After the feature is enabled, the device (serving as a TCP server) periodically
checks the number of TCP connections in each state. If the device detects that the number of TCP
connections in a state exceeds the maximum number, it considers that a Naptha attack occurs and
accelerates the aging of TCP connections in this state. The device will stop accelerating the aging of TCP
connections when the number of TCP connections in the state is less than 80% of the maximum number
(1 at least).
To enable the protection against Naptha attack:
Step
1. Enter system view.
2. Enable the protection
against Naptha attack.
3. Configure the maximum
of TCP connections in a
state.
4. Configure the TCP state
check interval.
Command
system-view
tcp anti-naptha enable
tcp state { closing | established |
fin-wait-1 | fin-wait-2 | last-ack |
syn-received } connection-number
number
tcp timer check-state timer-value
247
Remarks
N/A
Disabled by default.
With the protection against Naptha
attack enabled:
•
The switch will periodically check
and record the number of TCP
connections in each state.
•
If the switch detects that the
number of TCP connections in a
state exceeds the maximum
number, the switch will consider
that as Naptha attacks and
accelerate the aging of these TCP
connections. The switch will not
stop accelerating the aging of TCP
connections until the number of
TCP connections in the state is less
than 80% of the maximum
number.
Optional.
5 by default.
If the maximum number of TCP
connections in a state is 0, the aging
of TCP connections in this state will
not be accelerated.
Optional.
30 seconds by default.