Protecting Against Tcp Rst Or Syn Dos Attacks; Preventing Tcp Paws Timestamp Dos Attacks - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE 2010-10-31 Configuration Manual

JunosE 11.3.x IP, IPv6, and IGP Configuration Guide

Protecting Against TCP RST or SYN DoS Attacks

tcp ack-rst-and-syn

Preventing TCP PAWS Timestamp DoS Attacks

50
Use the no version to restore the default value, 127.
See ip ttl
You can use the tcp ack-rst-and-syn command to help protect the router from denial
of service (DoS) attacks.
Normally, when it receives an RST or SYN message, TCP attempts to shut down the TCP
connection. This action is expected under normal conditions, but someone maliciously
generating valid RST or SYN messages can cause problems for TCP and the network as
a whole.
When you enable the tcp ack-rst-and-syn command, the router challenges any RST or
SYN messages that it receives by sending an ACK message back to the expected source
of the message. The source reacts in one of the following ways:
If the source did send the RST or SYN message, it recognizes the ACK message to be
spurious and resends another RST or SYN message. The second RST or SYN message
causes the router to shut down the connection.
If the source did not send the RST or SYN message, the source accepts the ACK
message as part of an existing connection. As a result, the source does not send another
RST or SYN message and the router does not shut down the connection.
NOTE: Enabling this command slightly modifies the way TCP processes
RST or SYN messages to ensure that they are genuine.
Use to help protect the router from TCP RST and SYN denial of service attacks.
Example
host1(config)#tcp ack-rst-and-syn
Use the no version to disable this protection.
See tcp ack-rst-and-syn
The TCP Protect Against Wrapped Sequence (PAWS) number option works by including
the TCP timestamp option in all TCP headers to help validate the packet sequence
number.
Normally, in PAWS packets that have the timestamps option enabled, hosts use an
internal timer to compare the value of the timestamp associated with incoming segments
against the last valid timestamp the host recorded. If the segment timestamp is larger
than the value of the last valid timestamp, and the sequence number is less than the last
Copyright © 2010, Juniper Networks, Inc.