Dell Brocade DCX, Configuration Manual

Page: 1059 / 1436

BigIron RX Series Configuration Guide 987
53-1001810-01
Protecting against TCP SYN attacks
34
Protecting against a blind TCP reset attack using the SYN bit
In a blind TCP reset attack, a perpetrator attempts to guess the SYN bits to prematurely terminate
an active TCP session.
To prevent a user from using the SYN bit to tear down a TCP connection, the SYN bit is subject to
the following rules when receiving TCP segments:
•
If the SYN bit is set and the sequence number is outside the expected window, the device
sends an acknowledgement (ACK) back to the peer.
•
If the SYN bit is set and the sequence number is an exact match to the next expected
sequence, the device sends an ACK segment to the peer. Before sending the ACK segment, the
software subtracts one from the value being acknowledged.
•
If the SYN bit is set and the sequence number is acceptable, the device sends an
acknowledgement (ACK) segment to the peer.
The TCP security enhancement is enabled by default. To disable it, refer to “Disabling the TCP
security enhancement” on page 987.
Protecting against a blind injection attack
In a blind TCP injection attack, a perpetrator tries to inject or manipulate data in a TCP connection.
To reduce the chances of a blind injection attack, perform an additional check on all incoming TCP
segments.
This TCP security enhancement is enabled by default. To disable it, refer to “Disabling the TCP
security enhancement” on page 987.
Disabling the TCP security enhancement
The TCP security enhancement is automatically enabled. If necessary, you can disable this feature.
When you disable this feature, the
BigIron RX reverts to the original behavior.
To disable the TCP security enhancement, enter the following command at the Global CONFIG level
of the CLI.
BigIron RX(config)# no ip tcp tcp-security
To re-enable the TCP security enhancement once it has been enabled, enter the following
command.
BigIron RX(config)# ip tcp tcp-security
Syntax: [no] ip tcp tcp-security