Method and device for preventing synchronous packet attack

Abstract

The invention provides a method and device for preventing synchronous packet attack. The method comprises: pre-registering a hook function in a core, creating a tracking monitoring linked list and a blacklist linked list, and setting a synchronous packet threshold valve and a redetection interval time; parsing a TCP connection data packet sent by a client to a server by utilizing the hook function, wherein the TCP connection data packet transmitted in first handshake of the client and the server is the synchronous data packet; when the number of the synchronous data packets from a same IP address reaches the synchronous packet threshold value, adding the IP address into the tracking monitoring linked list, and tracking the TCP connection data packet subsequently sent by the corresponding client to the IP address; and parsing the tracked TCP connection data packet, and if the TCP connection data packet is determined to be an attack data packet, adding the IP address corresponding to the TCP connection data packet into the blacklist linked list. By adopting the method and device, the attack from a synchronous (SYN) packet can be prevented.

Description

technical field [0001] The invention relates to the technical field of communications, in particular to a method and device for preventing synchronous (SYN, synchronous) packet attacks. Background technique [0002] In the Transmission Control Protocol / Internet Protocol (TCP / IP, Transmission Control Protocol / Internet Protocol) protocol, the TCP protocol provides a reliable connection service and uses a three-way handshake to establish a connection. [0003] Suppose a client communicates with a server, the three-way handshake process is as follows: [0004] The first handshake, when the connection is established, the client sends a TCP packet (identification bit SYN=j) to the server, and enters the SYN_SEND state, at this time, the client waits for the server to confirm the TCP packet; [0005] The second handshake, when the server receives the TCP packet, it must confirm the client's SYN (ack=j+1), and at the same time send a TCP packet (syn=k), that is, the SYN+ACK packet,...

AI Technical Summary

Problems solved by technology

[0007] After the above three-way handshake is completed, the client can communicate with the server. From the perspective of the three-way handshake steps, if the client does not send a SYN+ACK packet during the third handshake, the server will not receive this packet. Under the circumstances, the server will generally retry to send SYN+ACK to the client again and discard the unfinished connection after waiting for a period of time. The length of this period of time is called SYNTimeout. Generally speaking, this time is on the order of minutes (about 30 seconds - 2 minutes), at this time the waiting process will occupy a certain amount of system resources, if the SYN+ACK packets from multiple ports cannot be received, then multiple threads will be waiting for connections, so system resources may eventually be consumed Exhaustion, crash or system restart, this kind of attack is a SYNflood attack. It can be seen that the SYN packet attack uses the third handshake vulnerability of the TCP / IP protocol TCP to establish a connection to implement an attack on the server

[0008] If a machine in the intranet acts as a server to provide some application services to the outside world, without a firewall, a large number of SYN packets from outside attack the host under the router. In severe cases, it may lead to host downtime or network paralysis

[0009] In the prior art, the solution on the router is to directly execute some commands to limit the number of SYN packets through the iptables command line in the user space, but if it is detected that the threshold is reached, the user data will be discarded, and there is no correction for user misoperation room for

Images