NetScreen firewall helps you detect and defend against nine DoS Attacks

 
DoS attack content review

1. The purpose of a Denial-of-Service attack is to exhaust the victim's resources with a large volume of virtual information flows, so that they cannot process legal information flows. The target of the attack can be the network resources protected by the firewall, the specific hardware platform or operating system of a certain host, and so on. Generally, the source address in DoS attacks is fraudulent.

2. DoS attacks from multiple source addresses are called Distributed Denial of Service (DDoS) attacks ). The source address in DoS attacks can be a fraudulent address or the actual address of the compromised host, or the actual address of the host from which the attacker is currently using the "zombie proxy.

3. netscreen firewall provides nine types of Denial-of-Service attack detection and Defense: session table flood attack detection and defense, SYN-ACK-ACK proxy flood attack detection and defense, SYN Flood Attack Detection and defense, ICMP flood attack detection and defense, UDP flood attack detection and defense, Land Attack Detection and defense, Ping of Death attack detection and defense, Teardrop Attack Detection and defense, and WinNuke attack detection and defense.

Detection and defense of DoS attacks-session table flood attacks

1. Attackers can fill up the firewall's session table so that the firewall cannot generate any new sessions and reject new connection requests, resulting in DoS attacks. Firewalls use source-target-based session restrictions and actively adjust the active failure mechanism of session timeout to mitigate such attacks.

2. Select SCREEN options "Source IP Based Session Limit" and "Destination IP Based Session Limit" to enable the Source and target Based Session restriction function. The default source-target-based session limit is 128 concurrent connections per second.

3. source-based session restrictions limit the number of concurrent sessions from the same source address and prevent DoS attacks such as Nimda and shock wave. These viruses will infect the server and then generate a large amount of information from the server. Because all the information flows generated by viruses originate from the same IP address, source-based session restrictions can ensure that the firewall can suppress such massive information flows. When the number of concurrent sessions from an IP address reaches the maximum value, the firewall begins to block all other connection attempts from this IP address. If the network has a shock wave virus, we can set the source-based session limit of the Intranet to a relatively low value (for example, set it to 50), those machines that cannot access the Internet, it is likely that it is infected with viruses, and immediately isolates it, detects and removes viruses, and patches it.

4. Attackers can launch distributed denial of service (DDoS) attacks on hundreds of hosts under their control. The target-based session restriction ensures that the firewall only allows a number of concurrent connection requests to reach any host regardless of the source. When the number of concurrent sessions on a server exceeds the limit, the firewall will block all other connection attempts on the server.

5. by default, the initial TCP three-way handshake timeout value is 20 seconds. After a session is established, the timeout value is changed to 1800 seconds. For HTTP and UDP, the timeout values are 300 seconds and 60 seconds respectively. When an attack occurs, the number of concurrent sessions increases rapidly, but due to the timeout value limit, those Unfinished Connection sessions will rapidly fill the session table.

The firewall provides an active failure mechanism. When the usage of the session table reaches a high limit (such as 80% of the maximum number of concurrent sessions), the session timeout value is shortened and the session is deleted in advance. When the usage of a session table is lower than a certain low value (such as 60% of the maximum number of concurrent sessions), the timeout value is restored to the default value, and the timeout process returns to normal. The active failure mechanism will shorten the default session timeout value with the set active failure rate and accelerate the session failure. The failure rate can be 2 ~ Select between 10 units (each unit represents 10 seconds ). This function needs to be set through commands.

Set flow aging low-watermark 60
Set flow aging high-watermark 80
Set flow aging early-ageout 6
The preceding settings enable the active invalidation mechanism to accelerate session failure when the number of concurrent sessions in the session table reaches 80%. In this case, the TCP session timeout value is shortened from 1800 seconds to 1740 seconds, the HTTP session timeout value is shortened from 300 seconds to 240 seconds, and the UDP session timeout value is shortened to 0. The firewall automatically deletes TCP sessions with a timeout value greater than 1740 seconds and HTTP sessions with a timeout value greater than 240 seconds. First, it begins to delete the earliest sessions. The setting that times out 60 seconds in advance causes all UDP sessions to time out and is deleted during the next spam. When the usage of the session table drops to 60% of the maximum number of concurrent sessions, the Stop acceleration fails and the session timeout value is restored to the original default value. This effectively blocks attacks that flood the firewall session tables.

Detection and defense of DoS attack -- SYN-ACK-ACK proxy Flood Attack

1. when the authenticated user initiates a Telnet or FTP connection, the firewall intercepts the SYN fragment from the user to Telnet or FTP server, creates an entry in its session table, and sends a SYN-ACK fragment to the user, the user then replies with ACK to complete the first three handshakes. Then, the firewall sends a logon prompt to the user. If the user is an attacker, he does not respond to login but continues to initiate a SYN-ACK-ACK session, which caused a flood of SYN-ACK-ACK proxy, will eventually fill the firewall session table, thus rejecting legitimate user connection requests.

2. to block this attack, you can start the SYN-ACK-ACK Proxy Protection option for SCREEN. After the number of connections from the same IP address reaches the SYN-ACK-ACK proxy threshold (default is 512, optional any integer between 1-250000 to adapt to different network environments) the firewall rejects more connection requests from this address.

DoS attack detection and defense-SYN flood attacks

1. uses a spoofed IP Source Address (nonexistent or inaccessibility) to send a large number of SYN fragments requesting TCP connections. These TCP connection requests cannot be completed, resulting in the memory buffer of the affected host being filled up, even if the operating system is damaged, the system cannot process valid connection requests. In this case, SYN flood occurs.

2. to block this attack, you can start the "SYN Flood Protection" option of SCREEN. The firewall sets the threshold for the number of SYN fragments per second through the specified object (target address and port, target address only or source address only, when the number of SYN fragments from the same source address or sent to the same target address reaches these thresholds, the firewall begins to intercept connection requests and proxy replies to SYN/ACK fragments, and store incomplete connection requests in the connection queue until the connection is completed or the request times out. When the queue of proxy connections in the firewall is filled up, the firewall rejects new SYN fragments from all addresses in the same security zone to prevent the network host from being attacked by incomplete three-way handshakes.

3. Set the following thresholds to detect and defend against SYN flood attacks.

Attack Threshold: The SYN proxy is activated when the number of SYN fragments sent to the same target address and port number reaches this Threshold (default value: 200 ). If Attack Threshold = 1000pps is set, when an attacker sends 999 FTP packets and 999 HTTP packets per second, each group of packets (packets with the same destination address and port number are considered as a group) none of them exceed the threshold of PPS, So SYN proxy is not activated.

Alarm Threshold: a warning is triggered when the number of uncompleted connection requests sent to the same destination address and port number by proxy per second exceeds this Threshold (default value: 1024 ). If Attack Threshold = 300 and Alarm Threshold = 1000 are set, the first 300 SYN fragments sent to the same target address and port number per second can be sent through the firewall within the same second, A warning will be triggered for 1000 SYN fragments after the firewall proxy and 1,001st proxy connection requests (that is, 1,301st connection requests within the second.

Source Threshold: Number of SYN fragments received per second from a single Source IP address (regardless of the target address and port number) before the firewall begins to discard connection requests from the Source IP address ). The default value is 4000pps. When this threshold is set, the firewall tracks the source address of the SYN Packet regardless of the target address and port number. When this threshold is exceeded, for the remaining time of the second and the next second, the firewall will reject all other SYN packets from the source address.

Distination Threshold: when the number of SYN fragments sent to a single target IP address (regardless of the target port number) exceeds this Threshold, the firewall rejects all new connection requests sent to the target IP address. The default value is 40000pps. If Distination Threshold = 1000pps is set, when an attacker sends 999 FTP packets and 999 HTTP packets per second, the firewall regards the FTP and HTTP packets sent to the same target as members of a group, and reject the 1,001st packets (FTP or HTTP packets) sent to the target address ).

Timeout: The maximum waiting time before an unfinished TCP connection is discarded from the proxy connection queue. The default value is 20 seconds.

Queue size: Maximum number of proxy connection requests in the proxy connection Queue before the firewall starts to reject new connection requests. The default value is 10240.

Detection and defense of DoS attacks-ICMP flood attacks

1. When the victim uses up all resources to respond to ICMP requests and cannot process valid network information, ICMP flood occurs.

2. Enable the "ICMP Flood Protection" option of SCREEN to defend against ICMP Flood attacks. Once the threshold value is exceeded (1000 packets per second by default), the firewall rejects requests from the same security zone for the remaining time of the second and the next second) for more ICMP requests from all addresses.

Detection and defense of DoS attacks-UDP flood attacks

1. When an attacker sends a large number of IP packets containing UDP datagram to slow down the operation of the victim, so that the victim cannot process valid connections, UDP flood occurs.

2. Enable the "UDP Flood Protection" option of SCREEN to defend against UDP Flood attacks. If the number of UDP datagram messages sent to a single target exceeds the set threshold (1000 packets per second by default ), the firewall rejects more UDP datagram from the same security zone and sent to the target address for the remaining time of the second and the next second.

Detection and defense of DoS attacks-Land attacks

1. Land attacks combine SYN flood attacks and IP address spoofing. When an attacker sends a large number of SYN packets using the attacker's IP address as the source and target addresses, a Land attack occurs. The attacker sends a SYN-ACK packet to himself to respond, creating an empty connection that persists until the connection times out. A large number of empty connections consume system resources, resulting in DoS.

2. Enable the "Land Attack Protection" option of SCREEN to block Land attacks. The firewall organically combines SYN flood protection and IP Address Spoofing defense technologies to defend against such attacks.

DoS attack detection and defense-Ping of Death Attack

1. The IP protocol specifies that the maximum IP packet length is 65535 bytes, including a packet header usually 20 bytes. An ICMP Response Request is an IP packet containing an 8-byte ICMP packet header. Therefore, the maximum length of the ICMP Response Request data zone is 65507 bytes (65535-20-8 ).

2. Many ping programs allow users to specify a packet size greater than 65507 bytes. When sending an excessively large ICMP packet, it will be split into many fragments, and the reorganization process may cause the acceptance system to crash.

3. Enable the "Ping of Death Attack Protection" option of SCREEN. The firewall will detect and reject these large and irregular packets, even if the attacker hides the total packet size through deliberate segmentation.

DoS attack detection and defense-Teardrop Attack

1. The fragmentation offset field of the IP packet header indicates the starting position or offset of the data contained in the packet fragmentation from the original unsegmented data package. When the starting position of a packet fragment overlaps with the ending position of the previous packet (for example, the offset of a packet is 0, the length is 820, And the offset of the next packet is 800 ), some systems may crash when reorganizing packets, especially those with vulnerabilities. Teardrop attacks take advantage of IP packet fragmentation.

2. Enable the "Teardrop Attack Protection" option of SCREEN. As long as the firewall detects this difference in packet fragmentation, the packet will be discarded.

DoS attack detection and defense-WinNuke attack

1. The WinNuke attack targets computers running Windows on the Internet. Attackers send TCP Fragments to a host with established connections (usually to the NetBIOS port 139 with URG configured with an emergency sign), which leads to overlapping NetBIOS fragments, this causes the host running Windows to crash. After you restart the attacked machine, the following information is displayed:

An exception OE has occurred at 0028: [address] in VxD MSTCP (01)
Authorization 41ae. This was called from 0028: [address] in VxD NDIS (01)
00008660. It may be possible to continue normally.
Press any key to attempt to continue.
Press ctrl alt del to restart your computer. You will lose any unsaved information in all applications.
Press any key to continue.
2. enable the "WinNuke Attack Protection" option of SCREEN. The firewall scans all packets flowing into port 139 (NetBIOS Session Service). If one of the packets is set with the URG flag, the firewall will cancel the URG flag, clear the URG pointer, forward the modified pointer, and write an entry in the event log, indicating that it has blocked a WinNuke attack attempt.

Firewall applications are currently more practical and popular detection and defense devices. Have you learned the preceding nine methods to prevent DoS attacks? This is very practical for studying network security.