AsGa Light
AsGa Light
AsGa Light
AsGa LightBOLT
BOLT
BOLT
BOLT 10GigE Switch
10GigE Switch
10GigE Switch
10GigE Switch
U
U
U
User Guide
ser Guide
ser Guide
ser Guide
Configuration
Configuration
Configuration
Configuration
35
3.22.7 TCP fragment attack
The attack consists of requesting a TCP connection fragmented into two IP packets. The
first IP packet of 68 bytes only holds the 8 first bytes of the TCP header (source and destination ports
and sequence number). The data in the second IP packet then holds the TCP connection request
(SYN flag is 1 and ACK flag is 0).
However, IP filters apply the same rule to all the fragments in a packet. The filter of the first
fragment (Fragment Offset = 0) defines the rule, accordingly it applies to the other fragments
(Fragment Offset = 1) without any other type of control. So, when defragmenting at IP level on the
target machine, the connection request packet is rebuilt and passed to the TCP layer. The connection
is established despite the IP filter in between which should have prevented it.
Under this setting the system will check for highly TCP fragmented packet and with payloads minors
than those specified by “minimun-tcp-header-allowed”.
Default value 20
.
COMMAND
DESCRIPTION
AsGOS#
configure terminal
Enter the Configure mode.
AsGOS(config)#
denial-of-service
Enter into Dos mode configuration.
AsGOS(config-dos)#
tcp-fragment-attack enable
Enable TCP fragment protection.
AsGOS(config-dos)#
minimun-tcp-header-allowed 20
Modify the minimum TCP header allowed.
AsGOS(config-dos)#
end
All packets detected under those conditions will be discarded.
3.22.8 Source IP equal to destination IP attack
This type of attack named LAND attack involves IP packets where the source and
destination address are set to address the same device. The attack involves sending a spoofed TCP
SYN packet (connection initiation) with the target host's IP address and an open port as both source
and destination. The reason a LAND attack works is because it causes the machine to reply to itself
continuously.
UDP/TCP packets where destination ports is the same as source ports are also
considered land type attacks.
Under this setting the system will check for SIP equal to DIP and UDP and TCP source and
destination equals ports.
COMMAND
DESCRIPTION
AsGOS#
configure terminal
Enter the Configure mode.
AsGOS(config)#
denial-of-service
Enter into Dos mode configuration.
AsGOS(config-dos)#
sip-dip-protection enable
SAIP = DAIP checking.
AsGOS(config-dos)#
tcp-udp-sp-equal-dp enable
Source and Destination TCP/UDP checking.
AsGOS(config-dos)#
end
All packets detected under those conditions will be discarded.
3.22.9 Check on invalid TCP flags
TCP is an abbreviation for the Transmission Control Protocol, defined in RFC 793 which was
released in September of 1981. TCP is a connection oriented protocol that can reliably get information
from one host to another across a network. By reliable, we mean that TCP guarantees all data will
arrive uncorrupted at the remote host, automatically detecting dropped or corrupted packets and
resending them as needed.
Every TCP packet includes a header, which is defined by the RFC as follows:
