Detections
Analytics

GEN003612 - The system must be configured to use TCP syncookies when experiencing a TCP SYN flood.

Information

A TCP SYN flood attack can cause Denial of Service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies are a mechanism used to only track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This technique does not operate in a fully standards-compliant manner, but is only activated when a flood condition is detected, and allows defense of the system while continuing to service valid requests.

Solution

Configure the system to use TCP syncookies when experiencing a TCP SYN flood.
Edit /etc/sysctl.conf and add a setting for 'net.ipv4.tcp_syncookies=1'.
# sysctl -p

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|II, CCE|CCE-4265-5, CCI|CCI-001092, Group-ID|V-22419, Rule-ID|SV-37633r1_rule, STIG-ID|GEN003612, Vuln-ID|V-22419

Plugin: Unix

Control ID: 8ecd76b843eec7ae8fe5eacfcc678feabd3de84e1cdc76df41f99a5e80bc72e2