Symantec™ Security Gateways Reference Guide - Sawmill

Preventing attacksLogical network interfaces119Adaptive SYN flood handling algorithm (always on)The security gateway’s driver, as well as the TCP layer, maintains the state of all connections through thesecurity gateway. To protect itself, the security gateway continuously monitors and tracks the number ofunestablished connections in the driver. Every minute, the driver reviews the number of unestablishedconnections to see if any have exceeded the default establishment period of 60 seconds. Any connectionsthat have exceeded the 60 second timeout period are terminated by sending a RST to the TCP layer. Thisterminates the connection in both the driver and the stack, and immediately frees up the memory.The adaptive SYN flood algorithm also acts as a throttle when the security gateway is under attack. Inaddition to terminating unestablished connections every minute, this algorithm also keeps track of howmany connections were terminated during each interval. If the number of terminated connections in agiven cycle (one minute) exceeds 100, the security gateway confirms that the system is under attack, andcuts the establishment time in half to 30 seconds.Algorithm 1Algorithm 1 instructs the driver to first check the trusted client list for each new SYN it receives. If theconnection is not in the trusted client list, the driver adds the connection information, along with a timestamp, to one of 16 lists determined by the destination port. Each list holds a maximum of 32 pendingconnections.If the driver sees that a selected list has reached the 32 record maximum, the driver examines that list,beginning with the first record, for a connection that has exceeded the 60 second time limit. The driverdrops the first expired connection record it finds and appends the new connection record to the end of thelist. The algorithm does not assume that the first connection record in the list is the oldest. Times on eachconnection record are adjusted if the security gateway receives a SYN resend.Connection records are removed from the lists when the final phase of the three-way handshake iscompleted (the security gateway receives the corresponding ACK from the client). If the three-wayhandshake is successful, the security gateway adds the connection record to the trusted client list.Algorithm 2Enable port scan detectionAlgorithm 2 relies on the fact that many SYN flood attacks originate from a spoofed IP address. For eachnew connection, algorithm 2 begins by checking the security gateway’s trusted client list. If the connectionis not in the trusted client list, algorithm 2 instructs the driver to hold the connection’s source address andsequence number, create a bogus ACK, send this packet to the connection’s source IP address, and wait fora response. If the source IP address is legitimate, the security gateway should receive a RST (reset) backfrom the source address as the source address would not have a pending connection for the bogus ACK’ssequence number. When this happens, the security gateway considers the original connection valid, andadds the source address to its trusted client list.Algorithm 2 is a lightweight, low-overhead method to detect SYN flood attempts, but is reliant on the clientusing a normal network stack. Some special breed stacks may not automatically send out a RST, and usingalgorithm 2 would prevent those systems from connecting. There is also the highly unlikely probabilitythat an initial connection arrives and begins the verification process, and before it completes, a newconnection arrives with an identical sequence number. In this case, the second connection overwrites thepending information for the first, forcing the first connection to connect again.A port scanning attack is an attempt to connect to one or more ports to identify compromisable services.Port scanning detection is an optional feature that the security gateway administrator can configure. Whenport scanning is enabled, it is enabled for reserved ports under 1024. Port scan detection does not preventthe security gateway from being scanned; it is a notification only. If the driver suspects port scanning, itlogs the interface on which the packet arrived, the source IP address, the IP header, and the total length ofthe IP packet. Once the driver has collected and logged this information it passes the packets.