TCP Flood ID: 8501

[craymond]

On our user TAP interface (a TAP that collects user trafic only), we see 1000's of TCP flood events from 0.0.0.0 to 0.0.0.0 ; port 0 to port 0; Zone user to Zone user. It is always Session ID of 0. I have tried to do packet captures, but I never seem to get anything. It also doesn't show in session browser (probably because the session is 0!) Anyone else see this? Any idea what this is?

[kfindlen]

This threat ID is triggered by zone protection or DoS policies applied to the sessions.  It should be triggered by the SYN flood alert and activate rate being set low enough to trigger under normal traffic loads.  Could you see what these values are set for along with the output from the CLI command below?

show session info

The session info should show you the new connection establish rate which should give some indication of the SYN rate the device is seeing.

[craymond]

Zone protection is set to "default" on the user zone. I didn't see anything under "show session info" but using "show zone-protection" I did see:

Zone User, vsys vsys1, profile default

-------------------------------------------------------------------------------

  tcp-syn              RED enabled: yes

    alarm rate:  10000pps   activate rate:  10000pps   maximal rate:  40000pps

    current:       115   packets dropped:12400

So I would guess this is the answer to what this is! Any idea what could cause it?

[kfindlen · Accepted solution]

SYN flood protection on zone protection allows the firewall to drop SYN packets when they exceed the activate rate.  RED stands for random early drop and means that once the activate rate has been exceeded that SYN packets will be dropped at random to mitigate a possible SYN flood.

Since you are in TAP mode the value of zone protection is diminished as all traffic is dropped after processing in any case.  When a packet is dropped by RED that packet is not forwarded to the dataplane for session setup and inspection, and no traffic log is created.

Please verify that the alarm, activate, and maximal rates are set for appropriate values for your environment.  If under normal traffic loads you see bursts of new TCP sessions above 10,000/sec then you would want to increase these values to take that into account.  The alarm rate is the rate that is required to trigger the threat log entry, while the activate rate is when packets begin being dropped.

[craymond]

Thanks kfindlen. I also found this from another message:

We don’t log the IP addresses because in a DDoS attack there could be hundreds or even thousands of IPs that were associated with the syn flood attack. We can’t log all of the IPs and showing only one for source and dest could be misleading.

So I think that covers it.