13-4
The SYN Cookie feature can prevent SYN Flood attacks. After receiving a TCP connection request,
the server directly returns a SYN ACK message, instead of establishing an incomplete TCP
connection. Only after receiving an ACK message from the client can the server establish a
connection, and then enter the ESTABLISHED state. In this way, large amounts of incomplete TCP
connections could be avoided to protect the server against SYN Flood attacks.
Follow these steps to enable the SYN Cookie feature:
To do...
Use the command...
Remarks
Enter system view
system-view
—
Enable the SYN Cookie feature
tcp syn-cookie enable
Required
Enabled by default.
z
If MD5 authentication is enabled, the SYN Cookie feature will not function after enabled. Then, if
you disable MD5 authentication, the SYN Cookie feature will be enabled automatically.
z
With the SYN Cookie feature enabled, only the MSS, instead of the window’s zoom factor and
timestamp, is negotiated during TCP connection establishment.
Configuring TCP Attributes
Configuring TCP Optional Parameters
TCP optional parameters that can be configured include:
z
synwait timer: When sending a SYN packet, TCP starts the synwait timer. If no response packet
is received within the synwait timer interval, the TCP connection cannot be created.
z
finwait timer: When a TCP connection is changed into FIN_WAIT_2 state, the finwait timer is
started. If no FIN packets is received within the timer interval, the TCP connection is terminated. If
a FIN packet is received, the TCP connection state changes to TIME_WAIT. If a non-FIN packet
is received, the system restarts the timer upon receiving the last non-FIN packet. The connection
is broken after the timer expires.
z
Size of TCP receive/send buffer
Follow these steps to configure TCP optional parameters:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Configure the TCP synwait timer
tcp timer syn-timeout time-value
Optional
75 seconds by default.
