| 12.3 |  | Attack Guards |
| 12.3.4 |  | AAA flood guard |

| DoS attacks are based on the premise of utilizing the resources of a device so extensively that other legitimate traffic is crowded out. For example, when AAA is being used in a network for authentication, a common DoS attack is to send many forged authentication requests to the PIX thus overwhelming AAA resources.

The

floodguard command is designed to help the PIX Security Appliance combat this problem. This command enables the PIX to reclaim resources when the user authentication (uauth) subsystem runs out of resources. If an inbound or outbound uauth connection is being attacked or overused, the PIX actively reclaims TCP resources. When the resources are depleted, the PIX Security Appliance sends list messages about it being out of resources or out of TCP users. If the PIX Security Appliance uauth subsystem is depleted, TCP user resources are reclaimed depending on urgency in the following order:

1. Timewait
2. FinWait
3. Embryonic
4. Idle

The

floodguard command is explained in the Command Reference.