Setting A Ttl Value; Protecting Against Tcp Rst Or Syn Dos Attacks - Juniper IGP - CONFIGURATION GUIDE V11.1.X Configuration Manual

interfaces. If the member is an indirect next hop, the interface is obtained by using
the forwarding equivalence class (FEC) to which the member points. This method of
resolving members occurs only if the FEC, pointed to by the indirect next hop, is
either an interface or a direct next hop.
An indirect next hop member is not resolved to an interface if it points to another
indirect next hop or to an equal cost multipath. ECMP fast reroute functionality is
not available if any interfaces that correspond to unresolved indirect next hop
members go down.
If you modify an indirect next hop member to point to a different FEC (that is, a
different interface, direct next hop, indirect next hop, or ECMP), the indirect next
hop member is not resolved for the new changes.

Setting a TTL Value

You can use the ip ttl command to set the TTL (time-to-live) field in the IP header
for all IP operations. The TTL specifies a hop count. This configured TTL value can
be overridden by other commands that specify a TTL.
ip ttl

Protecting Against TCP RST or SYN DoS Attacks

You can use the tcp ack-rst-and-syn command to help protect the router from denial
of service (DoS) attacks.
Normally, when it receives an RST or SYN message, TCP attempts to shut down the
TCP connection. This action is expected under normal conditions, but someone
maliciously generating valid RST or SYN messages can cause problems for TCP and
the network as a whole.
When you enable the tcp ack-rst-and-syn command, the router challenges any RST
or SYN messages that it receives by sending an ACK message back to the expected
source of the message. The source reacts in one of the following ways:
Use to set a default value for the IP header TTL field for all IP operations.
Example
host1(config)#ip ttl 255
Use the no version to restore the default value, 127.
See ip ttl
If the source did send the RST or SYN message, it recognizes the ACK message
to be spurious and resends another RST or SYN message. The second RST or
SYN message causes the router to shut down the connection.
Chapter 1: Configuring IP
51
IP Routing