MicroNugget: How to Prevent TCP Syn-Flood Attacks

Рет қаралды 40,833

Күн бұрын

Пікірлер: 29

@sosexv1 12 жыл бұрын

I'm on my cisco track. just passed my ccent and studying for my CCNA with cbtnugs. These kind of videos are very informative. thank you!

@cbtnuggets 12 жыл бұрын

If you visit our forums (on our website) you can request a series - this way we can track what's been requested & it's popularity. We also then have a way to mark if it's in production.

@huucyber 5 жыл бұрын

Note: If you want to perform attack, you need to configure access-list on ASA to allow TCP traffic from Outside to DMZ conf t access-list TCP permit tcp any host access-group TCP in interface outside end

@cbtnuggets 12 жыл бұрын

That's awesome! and thank you!

@friction5001 4 жыл бұрын

This video is so old but still got the job done thanks

@eduardd7289 6 жыл бұрын

Very informative. Thank you !

@KeithBarker 12 жыл бұрын

Hello Muhammad- Those are fantastic ideas! I will add them to my list. Thank you. Keith

@alittax Жыл бұрын

Great explanation! But what's the next step? Does the firewall wait for some time before it times out a given connection and it opens a new one?

@Taurus.x85 12 жыл бұрын

Fantastic Keith is awesome

@cbtnuggets 12 жыл бұрын

If you have any ideas for MicroNugget topics follow the link in the description and submit a few! We read each and every one.

@AlexeyTsapaev 6 жыл бұрын

great video! but how ASA manages to intercept those connections and control them? Whats more, a few servers can be under attack. Is ASA CPU that powerful or it is hardware accelerated?

@cantwaittowatch 5 жыл бұрын

Thanks for the presentation but what initially confused me was that the new red arrows you drew still might have gone thru the ASA but not directly as depicted, and after applying the policy map or rules, only 5 half filled connections were let thru.

@zee-trekking-trails 12 жыл бұрын

you should do a micro nugget on cisco ip sla. route tracking etc. and 2nd is traffic capture with wireshark. wireshark filters etc.

@nandorbacso4625 2 жыл бұрын

How is that the ASA doesn't get overwhelmed?

@Alireza-zc3kc 5 жыл бұрын

Hey Kieth thanks for this micro nugget. Would you please also create one for asymmetric routing issues while using HSRP that causes unicast flooding in the HSRP device, and how by reducing CAM table aging time euqal or less than ARP table time on HSRP devices it will solve the issue , it is one of the worst explained parts and most confusing parts of the CCNP route book on chapter 2. Thank you in advance

@Patrick-ky7ez 3 жыл бұрын

Maybe I missed something because I'm new to all this, but how does the ASA not get overwhelmed as well?

@cbtnuggets 3 жыл бұрын

Hi Patrick, thank you for your question! The ASA can still be overwhelmed, but there are still several factors to consider. The ASA will be forwarding based on the ACL rules, so if the permit is granted for a set of traffic, it will forward at wire speed for most ASA's. This will bog down the server in question since, the syn handshakes are occurring. To initiate the ASA and have it drop more then x number of open or hanging sync requests, this will help prevent the server from being overwhelmed. The ASA in the mean time will continue to drop those other syn requests as they come in. This will cause either the server to continue normal operations or have a slow poor experience for those who attempt to use that server. There is a balance in fine turning the bandwidth of limiting the syn handshakes to the server and what it can handle. A lot of newer firewalls are able to detect these attacks much more efficiently and handle the throughput to servers more effectively, minimizing the attack on a server. We hope this is helpful for you. Thank you for learning with us!