The A10 Networks ADC must protect against TCP SYN floods by using TCP SYN Cookies.
An XCCDF Rule
Description
<VulnDiscussion>A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target in an attempt to consume resources, making the device unresponsive to legitimate traffic. TCP SYN Cookies are commonly implemented by the Operating System on endpoints, but are also often implemented on network devices. A10 Networks ADCs provide protection against TCP SYN flood attacks by using SYN cookies. SYN cookies enable the device to continue to serve legitimate clients during a TCP SYN flood attack without allowing illegitimate traffic to consume system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-237063r639636_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
The following command enables hardware-based SYN cookies:
syn-cookie on-threshold [num] off-threshold [num]
Note: Hardware-based SYN cookies are available only on some models. If the "on-threshold" and "off-threshold" options are omitted, SYN cookies are enabled and are always on regardless of the number of half-open TCP connections.