MicroNugget: How to Prevent TCP Syn-Flood Attacks

Показать описание

In this video, Keith Barker covers what TCP syn-flood attacks are and how attackers can use them to overload a web server. He also describes how you can prevent these attacks from reaching your critical servers by using an ASA firewall. Finally, he shows you how you can test this to make sure that it is working properly.

After watching this video, you will not only know what TCP syn-flood attacks are but also how to stop them in an ASA firewall. Keith shows you this by simulating a real-life syn-flood attack on a web server. He then shows you how you can easily stop this by limiting the number of half-formed synchronization requests in ASA by using class and policy maps. This allows the firewall to verify synchronization requests once a specified threshold has been reached, only passing them onto the web server once they are fully formed. Finally, he demonstrates how you can verify that this is actually happening.

Start learning with CBT Nuggets:

Рекомендации по теме

Комментарии

I'm on my cisco track. just passed my ccent and studying for my CCNA with cbtnugs. These kind of videos are very informative. thank you!

sosexv

Note: If you want to perform attack, you need to configure access-list on ASA to allow TCP traffic from Outside to DMZ
conf t
access-list TCP permit tcp any host <IP of DMZ host>
access-group TCP in interface outside
end

huucyber

This video is so old but still got the job done thanks

friction

Hello Muhammad-

Those are fantastic ideas! I will add them to my list.

Thank you.

Keith

KeithBarker

great video! but how ASA manages to intercept those connections and control them? Whats more, a few servers can be under attack. Is ASA CPU that powerful or it is hardware accelerated?

MrTheAlexy

Great explanation! But what's the next step? Does the firewall wait for some time before it times out a given connection and it opens a new one?

alittax

If you visit our forums (on our website) you can request a series – this way we can track what's been requested & it's popularity. We also then have a way to mark if it's in production.

cbtnuggets

Thanks for the presentation but what initially confused me was that the new red arrows you drew still might have gone thru the ASA but not directly as depicted, and after applying the policy map or rules, only 5 half filled connections were let thru.

cantwaittowatch

you should do a micro nugget on cisco ip sla. route tracking etc.
and 2nd is traffic capture with wireshark. wireshark filters etc.

zee-trekking-trails

Hey Kieth thanks for this micro nugget. Would you please also create one for asymmetric routing issues while using HSRP that causes unicast flooding in the HSRP device, and how by reducing CAM table aging time euqal or less than ARP table time on HSRP devices it will solve the issue, it is one of the worst explained parts and most confusing parts of the CCNP route book on chapter 2. Thank you in advance

Alireza-zckc