Table of Contents
Advertisement
•
Smurf and Papasmurf type floods will be seen as ICMP Echo Responses at the victim side.
Unless FwdFast rules are in use, such packets are never allowed to initiate new connections,
regardless of whether or not there are rules that allow the traffic.
•
Fraggle packets may arrive at any UDP destination port targeted by the attacker. Tightening
the inbound rule set may help.
The Traffic Shaping feature built into NetDefendOS also help absorb some of the flood before it
reaches protected servers.
6.7.8. TCP SYN Flood Attacks
TCP SYN flood attacks work by sending large amounts of TCP SYN packets to a given port and
then not responding to SYN ACKs sent in response. This will tie up local TCP stack resources on
the victim's web server so that it is unable to respond to more SYN packets until the existing
half-open connections have timed out.
NetDefendOS can protect against TCP SYN Flood attacks if the Syn Flood Protection option is
enabled in a service object associated with the rule in the IP rule set that triggers on the traffic.
This is also sometimes referred to as the SYN Relay option.
Flood protection is enabled automatically in the predefined services http-in, https-in, smtp-in,
and ssh-in. If a new custom service object is defined by the administrator then the flood
protection option can be enabled or disabled as desired.
The SYN Flood Defence Mechanism
Syn flood protection works by completing the 3-way handshake with the client before doing a
second handshake of its own with the target service. Overload situations have difficulty
occurring in NetDefendOS due to superior resource management and an absence of the
restrictions normally placed on other operating systems. While other operating systems can
exhibit problems with as few as 5 outstanding half-open connections, NetDefendOS can fill its
entire state table before anything out of the ordinary happens. When the state table fills up, old
outstanding SYN connections will be the first to be dropped to make room for new connections.
Spotting SYN Floods
TCP SYN flood attacks will show up in NetDefendOS logs as excessive amounts of new
connections (or drops, if the attack is targeted at a closed port). The sender IP address is almost
invariably spoofed.
ALGs Automatically Provide Flood Protection
It should be noted that SYN Flood Protection does not need to be explicitly enabled on a service
object that has an ALG associated with it. ALGs provide automatic SYN flood protection.
6.7.9. The Jolt2 Attack
The Jolt2 type attack works by sending a steady stream of identical fragments at the victim
machine. A few hundred packets per second can freeze vulnerable machines completely until
the stream is ended.
NetDefendOS will protect completely against this attack. The first fragment will be queued,
waiting for earlier fragments to arrive so that they may be passed on in order, but this never
happens, so not even the first fragment gets through. Subsequent fragments will be thrown
away as they are identical to the first fragment.
569
Chapter 6: Security Mechanisms
- Quick Links:
- User Manual
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
