Specifying Black Hole Thresholds; Protecting Against Tcp Rst Or Syn Dos Attacks - Juniper IGP - CONFIGURATION GUIDE V11.1.X Configuration Manual

JUNOSe 11.0.x IP, IPv6, and IGP Configuration Guide

Specifying Black Hole Thresholds

Some domains might be configured not to generate certain ICMP messages (like an
ICMP destination unreachable message) or to filter all ICMP messages. Under these
conditions, the source of oversized ICMP packets never learns that it is sending
oversized packets. The device continues sending oversized packets that never get
through. This behavior is often referred to as a black hole.
A black hole threshold is a limit to the number of times a virtual router can retransmit
identical sequences of datagrams before the retransmissions are identified as a
problem.
tcp path-mtu-discovery black-hole-detect-threshold

Protecting Against TCP RST or SYN DoS Attacks

You can use the tcp ack-rst-and-syn command to help protect the router from denial
of service (DoS) attacks.
Normally, when it receives an RST or SYN message for an existing connection, TCP
attempts to shut down the TCP connection. This action is expected under normal
conditions, but someone maliciously generating otherwise valid RST or SYN messages
can cause problems for network applications and the network as a whole.
When you enable the tcp ack-rst-and-syn command, the router challenges any RST
or SYN messages that it receives by sending an ACK message back to the expected
source of the message. The source reacts in one of the following ways:
NOTE: Enabling this command slightly modifies the way TCP processes RST or SYN
messages to ensure that they are genuine.
tcp ack-rst-and-syn
146
IPv6 TCP Configuration
Use to specify the number of permitted retransmissions before the
retransmissions are determined to be a problem.
Example
host1:VR1(config)#tcp path-mtu-discovery black-hole-detect-threshold 200
Use the no version to disable black hole threshold detection.
See tcp path-mtu-discovery
If the source did send the RST or SYN message, it recognizes the ACK message
to be spurious and resends another RST or SYN message. The second RST or
SYN message causes the router to shut down the connection.
If the source did not send the RST or SYN message, the source accepts the ACK
message as part of an existing connection. As a result, the source does not send
another RST or SYN message and the router does not shut down the connection.