| 3.4 |  | Configure CBAC (Task 1 and 2) |
| 3.4.3 |  | Global half-open connections limit |

| An unusually high number of half-open sessions, either absolute or measured as the arrival rate, could indicate that a DoS attack is occurring. For TCP, half-open means that the session has not reached the established state, or the TCP three-way handshake has not yet been completed. For UDP, half-open means that the firewall has detected no return traffic.

CBAC measures both the total number of existing half-open sessions and the rate of session establishment attempts. Both TCP and UDP half-open sessions are counted in the total number and rate measurements. Measurements are made once a minute.

When the number of existing half-open sessions rises above a threshold, the

max-incomplete high number, CBAC will go in to aggressive mode and delete half-open sessions as required to accommodate new connection requests. The software continues to delete half-open requests as necessary, until the number of existing half-open sessions drops below another threshold, defined as the max-incomplete low number.

To define the number of existing half-open sessions that will cause the software to stop deleting half-open sessions, use the

ip inspect max-incomplete low command in global configuration mode. Use the no form of this command to reset the threshold to default. The syntax for the ip inspect max-incomplete low command is shown in Figure .

When the rate of new connection attempts rises above the

one-minute high number threshold, the software will delete half-open sessions as required to accommodate new connection attempts. The software continues to delete half-open sessions as necessary, until the rate of new connection attempts drops below the one-minute low number threshold. The rate thresholds are measured as the number of new session connection attempts detected in the last one-minute sample period. The firewall router reviews the one-minute rate on an ongoing basis, meaning that the router reviews the rate more frequently than once every minute and does not keep deleting half-open sessions for one minute after a DoS attack has stopped.

To define the rate of new un-established sessions that will cause the software to start deleting half-open sessions, use the

ip inspect one-minute high command in global configuration mode. Use the no form of this command to reset the threshold to default. The syntax for the ip inspect one-minute high command is shown in Figure .

| Lab Activity e-Lab Activity: Half-Open Connection Limits In this activity, students will configure the number of existing half-open sessions that will cause the software to start deleting half-open sessions.