مطلوب شركة حماية سرفرات

[Damas]

السلام عليكم ورحمة الله وبركاته

اخواني الي يعرف شركة تركيب حماية للسرفر من الفلود يرشدنا عليها

ومن عنده امكانية التركيب هذا المسنجر

damasgate@hotmail.com

[MinWin]

www.araserv.com
للحماية عنوان

و هذا ماسنجر صاحبها
admin (at) araserv.com

==============
كمان securityway.net
ممتازين

[REDSTAING]

What is a SYN Flood?

When a client system begins a connection to a server it sends a SYN message to the server. The server then acknowledges the SYN message by sending SYN-ACK message to the client. The client then finishes establishing the connection by responding with an ACK message. The connection between the client and the server is then open, and the service-specific data can be exchanged between the client and the server. Here is a view of this connection flow:

Client Server
SYN ---------->
<---------- SYN-ACK
ACK ---------->


Client and server can now send service-specific data.

A SYN attacker will overwhelm its victim with a flood of SYN packets. Every SYN packet forces the targeted server (victim) to produce a SYN-ACK response and then wait for the appropriate ACK. The attacker will not respond with an ACK or will spoof it destination IP address to one that does not exist resulting in no ACK response. This quickly leads to a situation where "half-open connections" pile up. When all available resources are used on half-open connections, the system stops acknowledging incoming SYN requests, including legitimate ones.

Client (Attacker) Server
SYN ------------>
<------------ SYN-ACK
ACK| Server waiting...
ACK| Server waiting...


The Server is flooded with SYN request that cannot be properly connected and results in a Denial of Service (DoS).

How does 8Signs Firewall protect against a SYN flood attack?

8Signs Firewall uses SYN Cookies for managing TCP connection attempts without using up any resources during the process. Since the goal of a SYN flood is to force a server to use up its resources so legitimate users cannot connect, using SYN Cookies makes a server much more resistant to this form of attack. SYN Cookies are in use in Linux and Free BSD to protect against SYN floods.

When 8Signs firewall sees a SYN flood attack, it blocks the initial TCP SYN packet that would otherwise be allowed through to the server. Instead, 8Signs Firewall replies itself. Where the server would quickly allocate all its resources and not be able to handle legitimate connections, 8Signs Firewall replies to them without losing any resources.

What's unique about 8Signs Firewall's SYN|ACK reply packet is in the way it chooses the Initial Sequence Number (ISN). This is the field that is called a SYN Cookie because this number (plus one) is returned in the ACK packet sent back when a legitimate connection is made. The ISN is made in a way that it is not guessable by the attacker. It is also tied to the IP address (and other information) of the connecting system. That way, when you receive this number back in the ACK reply, you can check whether it is a valid response.

During a SYN flood, the attacker sends only SYN packets in the hope that the victim will wait endlessly trying to finish the connections. With SYN Cookies, the firewall sends the SYN|ACK and "forgets" about it. It is when an ACK packet is received from the client that it decides if this is a valid connection attempt. It checks that the SYN Cookie is valid, and if it is, 8Signs Firewall establishes the connection with the server on behalf of the client. Once the connection is established, 8Signs Firewall lets the data packets pass through between client and server.

Once a SYN flood is over, 8Signs stops using SYN Cookies and returns to its normal state of letting clients connect to servers directly

[يونكس]

مطلوب >> قسم الطلبات و العروض

[k8ncom]

رد مقتبس من EldeebdotNet
www.araserv.com
للحماية عنوان

و هذا ماسنجر صاحبها
admin (at) araserv.com

[DokFLeed]

قمت باضافتك

المساعدة مجانية