HP 6125XLG R2306-HP 6125XLG Blade Switch Layer 3 - IP Services Configuration G - Page 118

Enabling TCP SYN Cookie, Configuring the TCP buffer size

Get HP 6125XLG PDF manuals and user guides View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals

Page 118 highlights

• When the TCP source device receives an ICMP error message, it reduces the path MTU and starts an age timer for the path MTU. • After the age timer expires, the source device uses a larger MSS in the MTU table as described in RFC 1191. • If no ICMP error message is received within 2 minutes, the source device increases the MSS again until the MSS is as large as the MSS negotiated during TCP three-way handshake. To enable TCP path MTU discovery: Step 1. Enter system view. 2. Enable TCP path MTU discovery. Command system-view tcp path-mtu-discovery [ aging age-time | no-aging ] Remarks N/A The default setting is disabled. Enabling TCP SYN Cookie A TCP connection is established through a three-way handshake: 1. The sender sends a SYN packet to the server. 2. The server receives the SYN packet, establishes a TCP semi-connection in SYN_RECEIVED state, and replies with a SYN ACK packet to the sender. 3. The sender receives the SYN ACK packet and replies with an ACK packet. A TCP connection is established. An attacker can exploit this mechanism to mount SYN Flood attacks. The attacker sends a large number of SYN packets, but does not respond to the SYN ACK packets from the server. As a result, the server establishes a large number of TCP semi-connections and can no longer handle normal services. SYN Cookie can protect the server from SYN Flood attacks. When the server receives a SYN packet, it responds with a SYN ACK packet without establishing a TCP semi-connection. The server establishes a TCP connection and enters ESTABLISHED state only when it receives an ACK packet from the client. To enable TCP SYN Cookie: Step 1. Enter system view. 2. Enable SYN Cookie. Command system-view tcp syn-cookie enable Remarks N/A The default setting is disabled. Configuring the TCP buffer size Step 1. Enter system view. 2. Configure the size of TCP receive/send buffer. Command system-view tcp window window-size Remarks N/A The default buffer size is 64 KB. 110

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
110
•
When the TCP source device receives an ICMP error message, it reduces the path MTU and starts
an age timer for the path MTU.
•
After the age timer expires, the source device uses a larger MSS in the MTU table as described in
RFC 1191.
•
If no ICMP error message is received within 2 minutes, the source device increases the MSS again
until the MSS is as large as the MSS negotiated during TCP three-way handshake.
To enable TCP path MTU discovery:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable TCP path MTU
discovery.
tcp path-mtu-discovery
[
aging
age-time
|
no-aging
]
The default setting is
disabled.
Enabling TCP SYN Cookie
A TCP connection is established through a three-way handshake:
1.
The sender sends a SYN packet to the server.
2.
The server receives the SYN packet, establishes a TCP semi-connection in SYN_RECEIVED state,
and replies with a SYN ACK packet to the sender.
3.
The sender receives the SYN ACK packet and replies with an ACK packet. A TCP connection is
established.
An attacker can exploit this mechanism to mount SYN Flood attacks. The attacker sends a large number
of SYN packets, but does not respond to the SYN ACK packets from the server. As a result, the server
establishes a large number of TCP semi-connections and can no longer handle normal services.
SYN Cookie can protect the server from SYN Flood attacks. When the server receives a SYN packet, it
responds with a SYN ACK packet without establishing a TCP semi-connection. The server establishes a
TCP connection and enters ESTABLISHED state only when it receives an ACK packet from the client.
To enable TCP SYN Cookie:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable SYN Cookie.
tcp syn-cookie enable
The default setting is disabled.
Configuring the TCP buffer size
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Configure the size of TCP receive/send
buffer.
tcp window
window-size
The default buffer size is 64 KB.