TCP Intercept
TCP Intercept is a network-level protection for SYN floods. It works by brokering (on the device running TCP Intercept) a connection to a server on behalf of the client. If an incoming connection never establishes itself, the client is not affected. When the connection does establish, the device running TCP intercept passes the communication on to the real server transparently. The Cisco PIX documentation does a good job of describing the feature in detail, so I've included it here. An embryonic connection in Cisco terminology is one that has not completed the full TCP three-way handshake:
Once the optional embryonic connection limit is reached, and until the embryonic connection count falls below this threshold, every SYN bound for the affected server is intercepted. For each SYN, P] Firewall responds on behalf of the server with an empty SYN/ACK segment. PIX Firewall retains pertinent state information, drops the packet, and waits for the client's acknowledgement. If the ACK is received, a copy of the client's SYN segment is sent to the server, and the TCP three-way handshake is performed between PIX Firewall and the server. If, and only if, this three-way handshake completes, may the connection can resume as normal. If the client does not respond during any part of the connection phase, PIX Firewall retransmits the necessary segment using exponential back-offs.
TCP Intercept has a number of options when implemented on routers; for more information, see the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur c/ftrafwl/scfdenl.htr On the Cisco PIX Firewall, TCP Intercept is part of the static command and has only one configurable option: the number of half-open connections to accept before starting the intercept function. More information on the static command can be found at
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix 62/cmdref/s.htm#1026694.
Continue reading here: Classic Dual Router DMZ
Was this article helpful?