Specifying Black Hole Thresholds; Protecting Against Tcp Rst Or Syn Dos Attacks - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE 2010-10-31 Configuration Manual

tcp path-mtu-discovery black-hole-detect-threshold

Protecting Against TCP RST or SYN DoS Attacks

Copyright © 2010, Juniper Networks, Inc.
Use to specify the minimum MTU value used for the path MTU. If the discovered PMTU
value is less than the minimum setting, path MTU discovery is disabled for this
connection.
Example
host1:VR1(config)#tcp path-mtu-discovery min-mtu 255
Use the no version to remove any limitation so that the virtual router uses the discovered
path MTU value.
See tcp path-mtu-discovery

Specifying Black Hole Thresholds

Some domains might be configured not to generate certain ICMP messages (like an ICMP
destination unreachable message) or to filter all ICMP messages. Under these conditions,
the source of oversized ICMP packets never learns that it is sending oversized packets.
The device continues sending oversized packets that never get through. This behavior is
often referred to as a black hole.
A black hole threshold is a limit to the number of times a virtual router can retransmit
identical sequences of datagrams before the retransmissions are identified as a problem.
Use to specify the number of permitted retransmissions before the retransmissions
are determined to be a problem.
Example
host1:VR1(config)#tcp path-mtu-discovery black-hole-detect-threshold 200
Use the no version to disable black hole threshold detection.
See tcp path-mtu-discovery
You can use the tcp ack-rst-and-syn command to help protect the router from denial
of service (DoS) attacks.
Normally, when it receives an RST or SYN message for an existing connection, TCP
attempts to shut down the TCP connection. This action is expected under normal
conditions, but someone maliciously generating otherwise valid RST or SYN messages
can cause problems for network applications and the network as a whole.
When you enable the tcp ack-rst-and-syn command, the router challenges any RST or
SYN messages that it receives by sending an ACK message back to the expected source
of the message. The source reacts in one of the following ways:
If the source did send the RST or SYN message, it recognizes the ACK message to be
spurious and resends another RST or SYN message. The second RST or SYN message
causes the router to shut down the connection.
Chapter 2: Configuring IPv6
141