Table of Contents
Advertisement
JunosE 11.3.x IP, IPv6, and IGP Configuration Guide
tcp ack-rst-and-syn
Preventing TCP PAWS Timestamp DoS Attacks
142
If the source did not send the RST or SYN message, the source accepts the ACK
message as part of an existing connection. As a result, the source does not send another
RST or SYN message and the router does not shut down the connection.
NOTE: Enabling this command slightly modifies the way TCP processes
RST or SYN messages to ensure that they are genuine.
Use to help protect the router from TCP RST and SYN denial of service attacks.
Example
host1(config)#tcp ack-rst-and-syn
Use the no version to disable this protection (the default mode).
See tcp ack-rst-and-syn
The TCP Protect Against Wrapped Sequence (PAWS) number option works by including
the TCP timestamp option in all TCP headers to help validate the packet sequence
number.
Normally, in PAWS packets that have the timestamps option enabled, hosts use an
internal timer to compare the value of the timestamp associated with incoming segments
against the last valid timestamp the host recorded. If the segment timestamp is larger
than the value of the last valid timestamp, and the sequence number is less than the last
acknowledgement sent, the host updates its internal timer with the new timestamp and
passes the segment on for further processing.
If the host detects a segment timestamp that is smaller than the value of the last valid
timestamp or the sequence number is greater than the last acknowledgement sent, the
host rejects the segment.
A remote attacker can potentially determine the source and destination ports and IP
addresses of both hosts that are engaged in an active connection. With this information,
the attacker might be able to inject a specially crafted segment into the connection that
contains a fabricated timestamp value. When the host receives this fabricated timestamp,
it changes its internal timer value to match. If this timestamp value is larger than
subsequent timestamp values from valid incoming segments, the host determines the
incoming segments as being too old and discards them. The flow of data between hosts
eventually stops, resulting in a denial of service condition.
Use the tcp paws-disable command to disable PAWS processing.
Copyright © 2010, Juniper Networks, Inc.
Advertisement
Table of Contents
