Title

The system must be configured to use TCP syncookies when experiencing a TCP SYN flood. (Cat II impact)

Discussion

A TCP SYN flood attack can cause Denial of Service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies are a mechanism used to not track a connection until a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This technique does not operate in a fully standards-compliant manner, but is only activated when a flood condition is detected, and allows defense of the system while continuing to service valid requests.

Check Content

# /usr/sbin/no -o clean_partial_conns If the value returned is not 1, this is a finding.

Fix Text

#/usr/sbin/no -p -o clean_partial_conns=1

Additional Identifiers

Rule ID: SV-38803r1_rule

Vulnerability ID: V-22419

Group Title: GEN003612

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.