Re: SYN floods - possible solution? (fwd)

[Steven L. Johnson]

Yes, using ICMP to try and do TCP SYN validation is bad.  In addition to
case where a firewalled site blocks ICMP, consider the case where a
group of hosts will respond to pings but have (some/much) TCP traffic to
them filtered by a conventional firewall.  These hosts can be used as
candidate source addresses for TCP SYN attack as they will respond to
the ICMP echo request but will not send a TCP RST to tear down the bogus
TCP connection.

Much better IMO to consider waiting for a TCP ACK response to TCP SYN
ACK for the requested TCP connection than to wait for ICMP echo response
at the firewall.  As noted before this is a very simple transparent
proxy service that can be implemented at the packet level very similar
to that of a NAT box.

-Steve

> 
> On Thu, 12 Sep 1996, Michael Dillon wrote:
> 
> ==>Now here is something that could be used by sites to protect against
> ==>SYN flood attacke assuming that they can build a special custom box
> ==>with enough RAM to buffer the sockets for 30 seconds or more. How high
> ==>
> ==>From: "Roderick Murchison, Jr." <murchiso@vivid.newbridge.com>
> ==>
> ==>Ok.  say you have a firewall between your network and you Internet
> ==>connection.  If that firewall could detect and *detain* a segment with the
> ==>SYN option set, then see if the set source IP answers an ICMP echo
> 
> This is bad.  You should never depend upon remote hosts to give you ICMP
> responses to establish connections.  This is because of several reasons:
> 
> 1.  What if a real remote site uses "established" connection firewalls
>     and chooses to block ICMP?  In that case, you've limited yourself
>     vastly as to what can connect to you (there are a lot of sites which
>     use cisco's "established" keyword to firewall and keep
>     functionality).
> 
> 2.  When links become congested, ICMP packets are given a lower priority
>     to make way for real data.
> 
> /cah
> 
> ----
> Craig A. Huegen  CCIE #2100                       ||        ||
> Network Analyst, IS-Network/Telecom               ||        ||
> cisco Systems, Inc., 250 West Tasman Drive       ||||      ||||
> San Jose, CA  95134, (408) 526-8104          ..:||||||:..:||||||:..
> email: chuegen@cisco.com                    c i s c o  S y s t e m s
> 

- - - - - - - - - - - - - - - - -