| 12.3 |  | Attack Guards |
| 12.3.5 |  | SYN flood attack |

| SYN flood attacks, also known as TCP flood or half-open connections attacks, are common DoS attacks perpetrated against IP servers. These attacks start with the attacker spoofing a nonexistent source IP address or IP addresses on the network of the target host. This floods the target host with SYN packets pretending to come from the spoofed host. Because SYN packets to a host are the first step in the three-way handshake of a TCP-type connection, the target responds to these spoofed hosts, as it would to any legitimate host, with SYN-ACK packets. However, because these SYN-ACK packets are sent to hosts that do not exist, the target sits and waits for the corresponding ACK packets that never show up. This causes the target to overflow its port buffer with embryonic or half-open connections and stop responding to legitimate requests.

Once the embryonic limit is set on a static translation, the PIX will keep track of all embryonic sessions on that translation (xlate) until the PIX tears them down or times them out.

For NAT, the embryonic connection limit on the PIX is set to a default value of zero, which means unlimited embryonic connections are allowed. The maximum depends on the connection license and the minimum is 1. A rule of thumb for the limit is the maximum number of connections to the connection license minus 30%; for example, on a 100,000-session license, set it to at least 70,000. Set it lower for slower systems, higher for faster systems. Below are connection license values for the PIX Security Appliances running OS 6.3.

Maximum connections per model:

- 501: 20,000
- 506: 50,000
- 515E: 175,000
- 525: 650,000
- 535: 1,000,000
- FWSM: 1,000,000

For static translations, set the embryonic limit to just under what the end host can handle for embryonic connections. It is suggested to set it to 120 because most servers can handle only 128 embryonic connections at a time.

The PIX Security Appliance uses the static and nat commands to protect hosts from SYN flood attacks. The static command is used to protect internal hosts against DoS attacks and the nat command is used to protect external hosts against these attacks. Both commands work by limiting the number of embryonic connections that are allowed to the server. The em_limit argument then limits the number of embryonic or half-open connections that the server or servers being protected can handle.

The SYN flood attacks and the use of the static and nat commands in order to prevent SYN Flood attacks are covered in the Command Reference.

| Lab Activity e-Lab Activity: Flood Defender In this activity, the student will demonstrate how to configure Flood Defender on the PIX Security Appliance.