Protecting Against Tcp Out Of Order Dos Attacks; Limiting Buffers Per Router - Juniper IGP - CONFIGURATION GUIDE V11.1.X Configuration Manual

JUNOSe 11.0.x IP, IPv6, and IGP Configuration Guide

Protecting Against TCP Out of Order DoS Attacks

You can use the group of tcp resequence-buffers commands to help protect the
router from TCP out-of-order packet DoS attacks.
TCP guarantees that applications receive data in order. This means that TCP buffers
any out-of-order packets it receives until ordered delivery can occur.
To prevent connections from consuming too many resources, TCP limits the amount
of data it accepts to the number of data bytes that the receiver is willing to receive
and buffer. TCP does not take into account the buffering scheme that the receiver
uses. If the receiver uses a fixed-size receive buffer (that is, buffering all packets)
regardless of length, a packet that contains only one data byte might consume many
data bytes of buffer space, but only one byte of TCP space.
Under these conditions, an attacker can send a large number of 1-byte packets to
an E Series router in which each packet is buffered, consuming an entire packet
buffer and eventually consuming a large amount of resources.
To defend against this sort of attack, you can set defaults and limits on the number
of outstanding buffers on reordering queues. You can configure these defaults and
limits on a per-router, per-virtual router, or per-connection within the virtual router
basis.

Limiting Buffers per Router

The tcp resequence-buffers global-maximum command enables you to limit the
number of outstanding buffers on the entire router.
tcp resequence-buffers global-maximum
148
IPv6 TCP Configuration
host1(config)#tcp paws-disable
Use the no version to restore PAWS processing (the default mode).
See tcp paws-disable
Use to specify a router-wide maximum number of buffers that resequencing
queues can contain.
Specify a value of zero (0) to turn off the limit.
Example
host1(config)#tcp resequence-buffers global-maximum
Use the no version to revert the global maximum buffer value to its default, 1000
buffers.
See tcp resequence-buffers global-maximum