Detecting an attack of a network connection
View Patent ↗To detect an attack of a network connection, detection of a message containing a sequence number that is within a valid sequence number range is performed, where the message is intended to cause reset of the network connection. The message is dropped, and a counter is incremented to track a number of occurrences of receiving the message in response to detecting that the sequence number in the message is within the valid sequence number range.
1. A method of detecting an attack of a network connection, comprising:
receiving, by a network device over a network, a first message containing a sequence number that is within a valid sequence number range, the first message intended to cause reset of the network connection;
dropping the first message even though the sequence number is within the valid sequence number range;
in response to detecting that the sequence number in the first message is within the valid sequence number range, incrementing a first counter to track a number of occurrences of receiving the first message;
receiving a data message containing a sequence number within the valid sequence number range and an acknowledge number outside a predefined acknowledge number range;
dropping the data message in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range; and
incrementing a second counter in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range.
2. The method of claim 1 , further comprising:
determining whether the sequence number in the first message matches exactly an expected sequence number,
wherein dropping the first message and incrementing the first counter is further in response to determining that the sequence number in the first message does not match the expected sequence number exactly.
3. The method of claim 2 , further comprising:
receiving a second message containing a sequence number that does not match the expected sequence number but is within the valid sequence number range, the second message intended to reset the network connection;
dropping the second message; and
in response to detecting that the sequence number in the second message does not match the expected sequence number but is within the valid sequence number range, incrementing the first counter again.
4. The method of claim 1 , wherein dropping the first message is performed instead of resetting the network connection in response to the first message.
5. The method of claim 4 , wherein receiving the first message comprises receiving one of a Transmission Control Protocol (TCP) reset message and a TCP synchronize message.
6. The method of claim 5 , wherein incrementing the first counter comprises incrementing a first counter in response to detecting the first message is a TCP reset message.
7. The method of claim 6 , further comprising incrementing a third counter in response to detecting the first message is a TCP synchronize message.
8. The method of claim 1 , wherein the first message comprises a Transmission Control Protocol (TCP) reset message, the method further comprising:
determining whether the sequence number in the TCP reset message matches exactly an expected sequence number,
wherein dropping the TCP reset message and incrementing the first counter is further in response to determining that the sequence number in the TCP reset message does not match the expected sequence number exactly;
receiving a second TCP reset message containing a sequence number that matches the expected sequence number; and
in response to the second TCP reset message, resetting the network connection, the network connection comprising a TCP connection.
9. The method of claim 1 , further comprising:
comparing a value of the first counter and a value of the second counter against respective thresholds; and
indicating an attack of the network connection is occurring in response to detecting the value of the first counter and the value of the second counter exceeding the respective thresholds.
10. The method of claim 5 , wherein receiving the data message comprises receiving a Transmission Control Protocol (TCP) data segment.
11. The method of claim 10 , wherein receiving the TCP data segment comprises receiving the TCP data segment containing the acknowledge number outside the predefined acknowledge number range but within a valid acknowledge number range according to TCP.
12. An article comprising at least one non-transitory machine-readable storage medium containing instructions that when executed cause a system to:
receive a synchronize message containing a sequence number within a valid sequence number range;
send an acknowledgment message in response to the synchronize message;
instead of resetting a network connection in response to the synchronize message, drop the synchronize message;
increment a first counter to track a number of occurrences of the synchronize message;
determine, based on a count value of the first counter, whether an attack of the network connection is occurring;
receive a data message containing a sequence number within the valid sequence number range and an acknowledge number outside a predefined acknowledge number range but within a valid acknowledge number range;
drop the data message in response to determining that the sequence number in the data message is within the valid sequence number range and the acknowledge number is outside the predefined acknowledge number range; and
increment a second counter in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range.
13. The article of claim 12 , wherein receiving the synchronize message comprises receiving a Transmission Control Protocol (TCP) synchronize segment.
14. The article of claim 12 , wherein the instructions when executed cause the system to further:
receive a reset message containing a sequence number that does not match an expected sequence number but is within the valid sequence number range;
instead of resetting the network connection in response to the reset message, dropping the reset message; and
incrementing a third counter to track a number of occurrences of the reset message in response to detecting that the sequence number in the reset message does not match the expected sequence number but is within the valid sequence number range.
15. The article of claim 12 , wherein the valid acknowledge number range is according to a Transmission Control Protocol (TCP).
16. A system capable of establishing a network connection with another network device, comprising:
a processor;
first and second counters; and
an attack detector executable in the processor to:
detect a first message containing a sequence number that does not match an expected sequence number but is within a valid sequence number range, the first message intended to cause reset of the network connection;
drop the first message even though the sequence number is within the valid sequence number range; and
in response to detecting that the sequence number in the first message does not match an expected sequence number but is within the valid sequence number range, increment the first counter to track a number of occurrences of receiving the first message;
receive a data message containing a sequence number within the valid sequence number range and an acknowledge number outside a predefined acknowledge number range but within a valid acknowledge number range;
drop the data message in response to determining that the sequence number in the data message is within the valid sequence number range and the acknowledge number is outside the predefined acknowledge number range; and
increment a second counter in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range.
17. The system of claim 16 , wherein the first message comprises a Transmission Control Protocol (TCP) reset message.
18. The system of claim 16 , wherein the attack detector is executable to detect a second message containing a sequence number that matches the expected sequence number, the second message intended to cause reset of the network connection, the system further comprising:
a controller adapted to, in response to detecting that the second message contains a sequence number that matches the expected sequence number, cause reset of the network connection.
19. The system of claim 16 , wherein the first message comprises at least one of a Transmission Control Protocol (TCP) reset message and a TCP synchronize message.
20. The system of claim 19 , wherein the data message is a TCP data segment.