Table of Contents
Advertisement
tcp paws-disable
Protecting Against TCP Out of Order DoS Attacks
tcp resequence-buffers global-maximum
Copyright © 2010, Juniper Networks, Inc.
NOTE: Disabling PAWS does not disable other processing related to the TCP
timestamp option. This means that even though you disable PAWS, a
fabricated timestamp that already exists in the network can still pollute the
database and result in a successful DoS attack. Enabling PAWS resets the
saved timestamp state for all connections in the virtual router and stops any
existing attack.
Use to disable the Protect Against Wrapped Sequence (PAWS) number option in TCP
segments.
You can specify a VRF context for which you want PAWS disabled.
Example
host1(config)#tcp paws-disable
Use the no version to restore PAWS processing (the default mode).
See tcp paws-disable
You can use the group of tcp resequence-buffers commands to help protect the router
from TCP out-of-order packet DoS attacks.
TCP guarantees that applications receive data in order. This means that TCP buffers any
out-of-order packets it receives until ordered delivery can occur.
To prevent connections from consuming too many resources, TCP limits the amount of
data it accepts to the number of data bytes that the receiver is willing to receive and
buffer. TCP does not take into account the buffering scheme that the receiver uses. If
the receiver uses a fixed-size receive buffer (that is, buffering all packets) regardless of
length, a packet that contains only one data byte might consume many data bytes of
buffer space, but only one byte of TCP space.
Under these conditions, an attacker can send a large number of 1-byte packets to an
E Series router in which each packet is buffered, consuming an entire packet buffer and
eventually consuming a large amount of resources.
To defend against this sort of attack, you can set defaults and limits on the number of
outstanding buffers on reordering queues. You can configure these defaults and limits
on a per-router, per-virtual router, or per-connection within the virtual router basis.
Limiting Buffers per Router
The tcp resequence-buffers global-maximum command enables you to limit the number
of outstanding buffers on the entire router.
Chapter 2: Configuring IPv6
143
Advertisement
Table of Contents
