Displaying statistics due dos attacks, Displaying statistics due dos attacks 1, Disabling the tcp security enhancement – Brocade BigIron RX Series Configuration Guide User Manual
Page 1159: Disabling the tcp, Security enhancement, Protecting against a blind injection attack
BigIron RX Series Configuration Guide
1081
53-1002484-04
Displaying statistics due DoS attacks
35
Protecting against a blind TCP reset attack using the SYN bit
In a blind TCP reset attack, a perpetrator attempts to guess the SYN bits to prematurely terminate
an active TCP session.
To prevent a user from using the SYN bit to tear down a TCP connection, the SYN bit is subject to
the following rules when receiving TCP segments:
•
If the SYN bit is set and the sequence number is outside the expected window, the device
sends an acknowledgement (ACK) back to the peer.
•
If the SYN bit is set and the sequence number is an exact match to the next expected
sequence, the device sends an ACK segment to the peer. Before sending the ACK segment, the
software subtracts one from the value being acknowledged.
•
If the SYN bit is set and the sequence number is acceptable, the device sends an
acknowledgement (ACK) segment to the peer.
The TCP security enhancement is enabled by default. To disable it, refer to
Protecting against a blind injection attack
In a blind TCP injection attack, a perpetrator tries to inject or manipulate data in a TCP connection.
To reduce the chances of a blind injection attack, perform an additional check on all incoming TCP
segments.
This TCP security enhancement is enabled by default. To disable it, refer to
Disabling the TCP security enhancement
The TCP security enhancement is automatically enabled. If necessary, you can disable this feature.
When you disable this feature, the device reverts to the original behavior.
To disable the TCP security enhancement, enter the following command at the Global CONFIG level
of the CLI.
BigIron RX(config)# no ip tcp tcp-security
To re-enable the TCP security enhancement once it has been enabled, enter the following
command.
BigIron RX(config)# ip tcp tcp-security
Syntax: [no] ip tcp tcp-security
Displaying statistics due DoS attacks
To display information about ICMP and TCP SYN packets dropped, passed, and block because burst
thresholds were exceeded.