Tcp Intercept – Deny DDOS attack
In order to prevent hackers using DDOS attacks against tcp syn-type servers, Cisco added the 12.4IOS characteristics of TCP Intercept
HACKER — R2 — server (1.1.1.1)
If a hacker to server after R2 launched DDOS type tcp syn flood attacks, launched a large number of half-open TCP session, trying to run out of server-side resources, R2, we can open the tcp intercept feature
Example 1:
/ / R2
access-list 144 permit tcp any host 1.1.1.1
ip tcp intercept list 144
ip tcp intercept mode intercept
ip tcp intercept connection-timeout 60
This is just a example, the R2 will allow the interception of all the TCP syn of 1.1.1.1 to the request sent back to the client, such as client-side there is response and completed the TCP three-way handshake, when will this be R2 conversation handed over to the 1.1.1.1. If during this period (60 seconds) did not receive responses to client-side or three-way handshake not completed, then empty the conversation.
Example 2:
access-list 144 permit tcp any host 1.1.1.1
ip tcp intercept list 144
ip tcp intercept mode watch
ip tcp intercept watch-timeout 15
The second case, R2 is not involved in client-side of the conversation between and 1.1.1.1, only the control of time, such as 15 seconds, client and server has not succeeded in establishing three-way handshake, then empty the conversation.
Intercept more than two modes is also known as the active mode, watch is also known as passive mode
View the document, then you will find that there is an aggressive mode, careful not to confuse the two models mentioned above, aggressive means that after more than the default threshold (default threshold is 1 minute session 1100, including unfinished connection – for intercept mode, with the connection request – for the watch mode), the default time to pack, such as watch-timeout default is 30 seconds, reduced to 15 seconds.
Attention to this case only for TCP SYN FLOOD category DDOS attacks, DDOS attacks, many different types, there will not be a so-called sun stroke, time to add other methods.
Praise God for all He is doing. Thanks!