Contents
SYN cookies is a technical attack mitigation technique whereby the server replies to TCP SYN requests with crafted SYN-ACKs, without inserting a new record to its SYN Queue. Only when the client replies this crafted response a new record is added.
How do I enable TCP SYN cookies?
Procedure
- Open the /etc/sysctl. conf to configure the host system.
- If the value is not set to 1 , add the following entry to the file or update the existing entry accordingly. Set the value to 1 . net.ipv4.tcp_syncookies=1.
- Save the changes and close the file.
- Run # sysctl -p to apply the configuration.
What is SYN proxy?
SYN Proxy is a network-based solution for detecting and mitigating TCP SYN Flood. It is an intermediate device on the network that verifies the three-way handshake process of TCP connections. If this process is successful, the connections between the client and server for data exchange will remain.
Is the use of SYN cookies compatible with TCP?
The use of SYN cookies does not break any protocol specifications, and therefore should be compatible with all TCP implementations. There are, however, two caveats that take effect when SYN cookies are in use.
In particular, the use of SYN cookies allows a server to avoid dropping connections when the SYN queue fills up. Instead, the server behaves as if the SYN queue had been enlarged. The server sends back the appropriate SYN+ACK response to the client but discards the SYN queue entry.
Who is the inventor of the SYN cookie?
SYN cookie is a technique used to resist SYN flood attacks. The technique’s primary inventor Daniel J. Bernstein defines SYN cookies as “particular choices of initial TCP sequence numbers by TCP servers.”.
The first implementation (for SunOS) was released by Jeff Weisberg a month later, and Eric Schenk released his Linux implementation in February 1997. FreeBSD implements syncookies since FreeBSD 4.5 (January 2002). ^ Kleen, Andi (May 31, 1999).