← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22419

CAT II (Medium)

The system must be configured to use TCP syncookies when experiencing a TCP SYN flood.

Rule ID

SV-46277r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-001092

Discussion

A TCP SYN flood attack can cause Denial of Service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies are a mechanism used to only track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This technique does not operate in a fully standards-compliant manner, but is only activated when a flood condition is detected, and allows defense of the system while continuing to service valid requests.

Check Content

Verify the system configured to use TCP syncookies when experiencing a TCP SYN flood.
# cat /proc/sys/net/ipv4/tcp_syncookies
If the result is not "1", this is a finding.

Fix Text

Configure the system to use TCP syncookies when experiencing a TCP SYN flood.
Edit /etc/sysctl.conf and add a setting for "net.ipv4.tcp_syncookies=1". 
# sysctl -p