Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a SYN Flood attack; which rules does TR7 apply against it?
Short answer
SYN flood is an attack that sends SYN packets, the first step of the TCP handshake, at a high rate, accumulates half-open connections on the target and, by filling the SYN backlog, prevents legitimate connections from being established (RFC 4987). In TR7, the SYN Flood box in the TCP band of the L4 DDoS Management screen carries four rules: SYN Flood: New-TCP Rate limits the number of SYN packets per second per source (default 500/s, default mode Monitor); SYN Flood: Not-SYN drops the packets that try to open a new connection without carrying the SYN flag, and SYN Flood: Bad MSS drops the SYN packets whose MSS value is outside the 536–65535 range (the default mode of both is Block); SYN Cookies (default Enabled), on the other hand, comes into play when the number of half-open connections exceeds the SYN Backlog Size value (default 4096).
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → TCP | SYN Flood box; the pencil icon on the rule row → Status (Disabled, Monitor, Block, Quarantine) | Setting the mode and the limit of the four rules |
| L4 DDoS Management → TCP | Connection Abuse box | Limiting the number of concurrent TCP connections per source |
| Left Monitor Panel → Route Tables & L4 DDoS → route table → Dashboard | Floods tab | Chart of the SYN rate per source together with the limit |
| Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Live View | quarantine table | The sources that the rules in Quarantine mode have put into quarantine |
- The details of SYN cookies: What are SYN Cookies; when do they come into play in TR7?
Common Misconceptions
- "SYN flood requires a lot of bandwidth." Even small SYN packets are enough to fill the backlog; the target is not the bandwidth but the connection table.
- "The 500/s limit is the total of all sources." The SYN Flood: New-TCP Rate limit is per source; each source carries its own counter.
- "The limit drops SYN packets by default." The default value of the rate rule is Monitor; in this mode, the rule measures and charts the rate per source and does not drop packets. To drop them, the Status field of the rule is set to Block or Quarantine.
How it is done in the documentation
Related questions
- What are SYN Cookies; when do they come into play in TR7?
- What is the difference between L4 DDoS Protection and L7 DDoS Protection?
- What are Null Flood and Christmas Tree Scan; why does TR7 block these packets without false positive risk?
- How do I limit the number of concurrent TCP connections from a single source in L4 DDoS; what does the Zombie TCP setting do?
