TCP Flood ID: 8501

Reply
Highlighted
L4 Transporter

TCP Flood ID: 8501

On our user TAP interface (a TAP that collects user trafic only), we see 1000's of TCP flood events from 0.0.0.0 to 0.0.0.0 ; port 0 to port 0; Zone user to Zone user. It is always Session ID of 0. I have tried to do packet captures, but I never seem to get anything. It also doesn't show in session browser (probably because the session is 0!) Anyone else see this? Any idea what this is?

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.

Accepted Solutions
Highlighted
L4 Transporter

SYN flood protection on zone protection allows the firewall to drop SYN packets when they exceed the activate rate.  RED stands for random early drop and means that once the activate rate has been exceeded that SYN packets will be dropped at random to mitigate a possible SYN flood.

Since you are in TAP mode the value of zone protection is diminished as all traffic is dropped after processing in any case.  When a packet is dropped by RED that packet is not forwarded to the dataplane for session setup and inspection, and no traffic log is created.

Please verify that the alarm, activate, and maximal rates are set for appropriate values for your environment.  If under normal traffic loads you see bursts of new TCP sessions above 10,000/sec then you would want to increase these values to take that into account.  The alarm rate is the rate that is required to trigger the threat log entry, while the activate rate is when packets begin being dropped.

View solution in original post


All Replies
Highlighted
L4 Transporter

This threat ID is triggered by zone protection or DoS policies applied to the sessions.  It should be triggered by the SYN flood alert and activate rate being set low enough to trigger under normal traffic loads.  Could you see what these values are set for along with the output from the CLI command below?

show session info

The session info should show you the new connection establish rate which should give some indication of the SYN rate the device is seeing.

Highlighted
L4 Transporter

Zone protection is set to "default" on the user zone. I didn't see anything under "show session info" but using "show zone-protection" I did see:

Zone User, vsys vsys1, profile default

-------------------------------------------------------------------------------

  tcp-syn              RED enabled: yes

    alarm rate:  10000pps   activate rate:  10000pps   maximal rate:  40000pps

    current:       115   packets dropped:12400

So I would guess this is the answer to what this is! Any idea what could cause it?

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.
Highlighted
L4 Transporter

SYN flood protection on zone protection allows the firewall to drop SYN packets when they exceed the activate rate.  RED stands for random early drop and means that once the activate rate has been exceeded that SYN packets will be dropped at random to mitigate a possible SYN flood.

Since you are in TAP mode the value of zone protection is diminished as all traffic is dropped after processing in any case.  When a packet is dropped by RED that packet is not forwarded to the dataplane for session setup and inspection, and no traffic log is created.

Please verify that the alarm, activate, and maximal rates are set for appropriate values for your environment.  If under normal traffic loads you see bursts of new TCP sessions above 10,000/sec then you would want to increase these values to take that into account.  The alarm rate is the rate that is required to trigger the threat log entry, while the activate rate is when packets begin being dropped.

View solution in original post

Highlighted
L4 Transporter

Thanks kfindlen. I also found this from another message:

We don’t log the IP addresses because in a DDoS attack there could be hundreds or even thousands of IPs that were associated with the syn flood attack. We can’t log all of the IPs and showing only one for source and dest could be misleading.

So I think that covers it.

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!