Enabling SYN Cookie
A TCP connection is established through a three-way handshake:
The sender sends a SYN packet to the server.
The server receives the SYN packet, establishes a TCP semi-connection in SYN_RECEIVED state, and replies with a SYN ACK packet to the sender.
The sender receives the SYN ACK packet and replies with an ACK packet. A TCP connection is established.
An attacker can exploit this mechanism to mount SYN Flood attacks. The attacker sends a large number of SYN packets, but does not respond to the SYN ACK packets from the server. As a result, the server establishes a large number of TCP semi-connections and can no longer handle normal services.
SYN Cookie can protect the server from SYN Flood attacks. When the server receives a SYN packet, it responds with a SYN ACK packet without establishing a TCP semi-connection. The server establishes a TCP connection and enters ESTABLISHED state only when it receives an ACK packet from the client.
To enable SYN Cookie:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Enable SYN Cookie. | tcp syn-cookie enable | By default, SYN Cookie is disabled. |