| 12.3 |  | Attack Guards |
| 12.3.6 |  | TCP intercept |

| In PIX Security Appliance software versions 5.2 and higher, the SYN Flood Guard feature of the static command offers an improved mechanism for protecting systems that can be reached via a static and TCP conduit from TCP SYN attacks. Previously, if an embryonic connection limit was configured in a static command statement, the PIX Security Appliance simply dropped any connection attempts once the embryonic threshold was reached. This meant that even a modest attack could stop Web traffic for an organization.

For static command statements without an embryonic connection limit, the PIX Security Appliance passes all traffic. If the target of an attack has no TCP SYN attack protection or insufficient protection, as with most operating systems, its embryonic connection table overloads and all traffic stops.

With the new TCP intercept feature in versions 5.2 and higher, once the optional embryonic connection limit is reached, and until the embryonic connection count falls below this threshold, every SYN bound for the affected server is intercepted. For each SYN, the PIX Security Appliance responds on behalf of the server with an empty SYN-ACK segment. The PIX Security Appliance retains pertinent state information, drops the packet, and waits for acknowledgement from the client. If the ACK is received, a copy of the SYN segment from the client is sent to the server and the TCP three-way handshake is performed between the PIX Security Appliance and the server. The three-way handshake must be completed for the connection to resume as normal.

The TCP Intercept feature requires no special configuration. The embryonic connection limits on both the static and nat commands contain the new behavior.