Method of preventing syn flood and router equipment

Abstract

The invention discloses a method and a router device, which are used for keeping away the flood attack of a syn when a TCP link is established. The method comprises that an agent water line and an attack water line is set; when the number of the half link exceeds the agent water line, the establishment of the TCP link is proceeded by the router instead of a server on the router device; after the TCP link is established, the TCP link is initiated to the server by the router instead of a client server; when the number of the half link reaches up to the attack water line, after a syn message is received, the half link with the longest existence time is aged and a time of retransmit-overtime is shortened; until the number of the half link is pushed out of the water line number, a normal work pattern is reentered. The invention realizes the response of the TCP link which is initiated to the client server by an agent server, which greatly saved resource and improves the use ratio of resource. And the effect of improving the security of the equipment is achieved.

Description

technical field [0001] The invention relates to a method for preventing syn flood attack when establishing TCP connection on router equipment, and also relates to a router equipment preventing syn flood attack when establishing TCP connection on router equipment. Background technique [0002] With the continuous development of broadband access technology, people are increasingly inseparable from the information and service platforms brought by the network, but the greater the dependence on the network, the higher the requirements for network security. [0003] In the current situation, denial of service attacks have become the main means of hacker attacks, and most of the targets of this attack are www servers. This service is based on the TCP protocol. For the services of the TCP protocol, syn flooding (syn flood ) attack is difficult to prevent. Currently syn flooding has become the most popular denial of service attack. [0004] A normal TCP connection requires a three-...

AI Technical Summary

Problems solved by technology

The syn flood attack mainly sends multiple syn requests to the server, but after the server returns a syn\ack response packet, it does not respond to the syn-ack request initiated by the server to achieve the purpose of consuming server resources, resulting in server resource consumption exhaustion, allowing the server to reject normal service requests

[0006] Such an attack greatly affects the response of the server to normal services, and poses a serious threat to the operation of enterprises and portals

Images