Use tcp interception on a cisco router to prevent dos Attacks

This article describes in detail how to intercept TCP to prevent DOS attacks on CISCO routers. I hope this article will help readers learn about CISCO routers.

1) define an acl to protect the machine:

Access-list 101 per tcp any host 202.106.0.20

Because there is no need to match the source address, generally dos is accompanied by address spoofing, so the source here is all any.

2) Enable tcp intercept globally.

Ip, tcp intercept list 101

3) set the tcp interception mode. There are two tcp interception modes: interception and monitoring. The interception mode is like a hooligans looking for a fault. It doesn't matter to anyone. The monitoring mode is a slightly rational rogue. It takes only 30 seconds for others to make a bet on the empty space at the door of his house ). I'm tired of seeing everyone. We need to be rational.

Ip tcp intercept mode watch

Ip tcp intercept watch-timeout 20

4) In addition, you cannot keep tcp connections for the rest of your life. Set a tcp timeout value. The default value is 24 hours. Generally, the timeout value is 30 minutes for Long-connected applications of special services in the network.

Ip tcp intercept connection-timeout 1800

5) The Maximum half-open connection threshold can also be changed. The default value is low 900 and high 1100.

Ip tcp intercept max-incomplete low 800

Ip, tcp, intercept, max-incomplete, high 1000

6) view the status

Show tcp intercept connecitons

Show tcp intercept statistics