Methods and systems for enhanced support of TCP options in a TCP spoofed system

1. A method comprising:

receiving, at a first proxy node, a first TCP (Transmission Control Protocol) SYN segment from a first endpoint to establish a TCP connection with a second endpoint, the first TCP SYN segment including a first TCP option having a first option-kind value;

transmitting a first spooled connection request message corresponding to the first TCP SYN segment from the first proxy node to a second proxy node associated with the second endpoint;

including, in response to the first TCP option having the first option-kind value, an indication in the first spoofed connection request message that a TCP option having the first option-kind value was included in the first TCP SYN segment;

receiving, at the first proxy node, a second TCP SYN segment from a third endpoint to establish a TCP connection with a fourth endpoint, the second TCP SYN segment including a second TCP option having a second option-kind value different from the first option-kind value;

transmitting a second spoofed connection request message corresponding to the second TCP SYN segment from the first proxy node to a third proxy node associated with the fourth endpoint; and

not including, in response to the second TCP option having the second option-kind value, an indication in the second spoofed connection request message that a TCP option having the second option-kind value was included in the second TCP SYN segment.

2. The method of claim 1 , wherein:

the first TCP SYN segment includes a third TCP option having a third option-kind value different from the first option-kind value: and

the method further includes not including, in response to the third TCP option having the third option-kind value, an indication in the first spoofed connection request message that a TCP option having the third option-kind value was included in the first TCP SYN segment.

3. The method of claim 1 , further comprising:

receiving, at the first proxy node, a first spoofed connection established message corresponding to the first spoofed connection request message from the second proxy node;

waiting, in response to the first TCP option having the option-kind value, for the receiving of the first spoofed connection established message before transmitting a first TCP SYN-ACK segment corresponding to the first TCP SYN segment from the first proxy node to the first endpoint;

receiving, at the first proxy node, a third TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixth endpoint, the third TCP SYN segment including a third TCP option having a third option-kind value different from the first option-kind value;

transmitting a third spoofed connection request message corresponding to the third TCP SYN segment from the first proxy node to a fourth proxy node associated with the sixth endpoint;

receiving, at the first proxy node, a second spoofed connection established message corresponding to the third spoofed connection request message from the second proxy node; and

transmitting, in response to the third TCP option having the third option-kind value, a second TCP SYN-ACK segment corresponding to the second TCP SYN segment from the first proxy node to the fifth endpoint before the receiving of the second spoofed connection established message.

4. The method of claim 1 , further comprising:

receiving, at the first proxy node, a third TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixth endpoint, the third TCP SYN segment including a third TCP option having a third option-kind value different from the first and second option- kind values;

blocking, at the first proxy node and in response to the third TCP option having the third option-kind value, establishing a TCP connection with the sixth endpoint in response to the received third TCP SYN segment;

receiving, at the first proxy node, a fourth TCP SYN segment from a seventh endpoint to establish a TCP connection with an eighth endpoint, the fourth TCP SYN segment including a fourth TCP option having a fourth option-kind value different from the first, second, and third option-kind values; and

transmitting, in response to the fourth TCP option having the fourth option-kind value, an unspoofed connection request message corresponding to the fourth TCP SYN segment from the first proxy node to a fourth proxy node associated with the eighth endpoint.

5. The method of claim 1 , further comprising:

transmitting a TCP SYN-ACK segment corresponding to the second TCP SYN segment from the first proxy node to the third endpoint; and

including, in response to the second TCP option having the second option-kind value, in the TCP SYN-ACK segment a TCP option having the second option-kind value.

6. The method of claim 1 , further comprising:

including, in response to the first TCP option having the first option-kind value, an option-data portion of the first TCP option in the first spoofed connection request message;

receiving, at the first proxy node, a spoofed connection established message corresponding to the first spoofed connection request message from the second proxy node, the spoofed connection established message including a first option-data portion associated with the first option-kind value;

transmitting a first TCP SYN-ACK segment corresponding to the first TCP SYN segment from the first proxy node to the first endpoint; and

including, in response to the first TCP option having the fust option-kind value, in the first TCP SYN-ACK segment a TCP option having the first option-kind value and including the first option-data portion of the spoofed connection established message.

7. The method of claim 6 , further comprising:

receiving, at the second proxy node, the first spoofed connection request message from the first proxy node;

transmitting, in response to the receiving of the first spoofed connection request message, a third TCP SYN segment from the second proxy node to the second endpoint;

including, in response to the first spoofed connection request message including the indication that a TCP option having the first option-kind value was included in the first TCP SYN segment, in the third TCP SYN segment a TCP option having the first option-kind value and including the option-data portion of the first TCP option included in the first spoofed connection request message;

receiving, at the second proxy node, a second TCP SYN-ACK segment corresponding to the third TCP SYN segment from the second endpoint, the second TCP SYN-ACK segment including a third TCP option having the first option-kind value and including an option- data portion; and

transmitting, in response to the receiving of die second TCP SYN-ACK segment, the spoofed connection established message from the second proxy node to the first proxy node, first option-data portion of the spoofed connection established message including the opiion- data portion of the third TCP option.

8. The method of claim 1 , further comprising;

receiving, at the first proxy node, a third TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixth endpoint, the third TCP SYN segment including a first plurality of TCP options;

identifying a device make or model for the fifth endpoint based on the first plurality of TCP options included in the third TCP SYN segment; and

controlling handling of a network connection for the fifth endpoint in response to the identified device make or model.

9. A non-volatile machine-readable storage medium including instructions stored thereon that, responsive to execution by one or more processors, cause the one or more processors to perform the method of claim 1 .

10. A system comprising: one or more processors; and one or more machine-readable storage media including instructions stored thereon that, responsive to execution by the one or more processors, cause the system to perform operations including:

receiving, at a first proxy node, a first TCP (Transmission Control Protocol) SYN segment from a first endpoint to establish a TCP connection with a second endpoint, the first TCP SYN segment including a first TCP option having a first option-kind value;

transmitting a first spoofed connection request message corresponding to the first TCP SYN segment from the first proxy node to a second proxy node associated with the second endpoint;

including, in response to the first TCP option having the first option-kind value, an indication in the first spoofed connection request message that a TCP option having the first option-kind value was included in the first TCP SYN segment;

receiving, at the first proxy node, a second TCP SYN segment from a third endpoint to establish a TCP connection with a fourth endpoint, the second TCP SYN segment including a second TCP option having a second option-kind value different from the first option-kind value;

transmitting a second spoofed connection request message corresponding to the second TCP SYN segment from the first proxy node to a thiixi proxy node associated with the fourth endpoint; and

not including, in response to the second TCP option having the second option-kind value, an indication in the second spoofed connection request message that a TCP option having the second option-kind value was included in the second TCP SYN segment.

11. The system of claim 10 , wherein:

the first TCP SYN segment includes a third TCP option having a third option-kind value different from the first option-kind value; and

the method further includes not including, in response to the third TCP option having the third option-kind value, an indication in the first spoofed connection request message that a TCP option having the third option-kind value was included in the first TCP SYN segment.

12. The system of claim 10 , wherein the instructions further cause the system to perform operations including:

receiving, at the first proxy node, a first spoofed connection established message corresponding to the first spoofed connection request message from the second proxy node;

waiting, in response to the first TCP option having the option-kind value, for the receiving of the first spoofed connection established message before transmitting a first TCP SYN-ACK segment corresponding to the first TCP SYN segment from the first proxy node to the first endpoint;

receiving, at the first proxy node, a third TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixth endpoint, the third TCP SYN segment including a third TCP option having a third option-kind value different from the first option-kind value;

transmitting a third spoofed connection request message corresponding to the third TCP SYN segment from the first proxy node to a fourth proxy node associated with the sixth endpoint;

receiving, at the first proxy node, a second spoofed connection established message corresponding to the third spoofed connection request message from the second proxy node; and

transmitting, in response to the third TCP option having the third option-kind value, a second TCP SYN-ACK segment corresponding to the second TCP SYN segment from the first proxy node to the fifth endpoint before the receiving of the second spoofed connection established message.

13. The system of claim 10 , wherein the instructions further cause the system to perform operations including:

receiving, at the first proxy node, a thiixi TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixth endpoint, the third TCP SYN segment including a third TCP option having a third option-kind value different from the first and second option- kind values;

blocking, at the first proxy node and in response to the third TCP option having the third option-kind value, establishing a TCP connection with the sixth endpoint in response to the received third TCP SYN segment;

receiving, at the first proxy node, a fourth TCP SYN segment from a seventh endpoint to establish a TCP connection with an eighth endpoint, the fourth TCP SYN segment including a fourth TCP option having a fourth option-kind value different from the first, second, and third option-kind values; and

transmitting, in response to the fourth TCP option having the fourth option-kind value, an unspoofed connection request message corresponding to the fourth TCP SYN segment from the first proxy node to a fourth proxy node associated with the eighth endpoint.

14. The system of claim 10 , wherein the instructions further cause the system to perform operations including:

transmitting a TCP SYN-ACK segment corresponding to the second TCP SYN segment from the first proxy node to the third endpoint; and

including, in response to the second TCP option having the second option-kind value, in the TCP SYN-ACK segment a TCP option having the second option-kind value.

15. The system of claim 10 , wherein the instructions further cause the system to perform operations including:

including, in response to the first TCP option having the first option-kind value, an option-data portion of the first TCP option in the first spoofed connection request message;

receiving, at the first proxy node, a spoofed connection established message corresponding to the first spoofed connection request message from the second proxy node, the spoofed connection established message including a first option-data portion associated with the first option-kind value;

transmitting a first TCP SYN-ACK segment corresponding to the first TCP SYN segment from the first proxy node to the first endpoint; and

including, in response to the first TCP option having the first option kind value, in the first TCP SYN-ACK segment a TCP option having the first option-kind value and including the first option-data portion of the spoofed connection established message.

16. The system of claim 15 , wherein the instructions further cause the system to perform operations including:

receiving, at the second proxy node, the first spoofed connection request message from the first proxy node;

transmitting, in response to the receiving of the first spoofed connection request message, a third TCP SYN segment from the second proxy node to the second endpoint;

including, in response to the first spoofed connection request message including the indication that a TCP option having the first option kind value was included in the first TCP SYN segment, in the third TCP SYN segment a TCP option having the first option-kind value and including the option-data portion of the first TCP option included in the first spoofed connection request message;

receiving, at the second proxy node, a second TCP SYN-ACK segment corresponding to the thiixi TCP SYN segment from the second endpoint, the second TCP SYN-ACK segment including a third TCP option having the first option-kind value and including an option- data portion; and

transmitting, in response to the receiving of the second TCP SYN-ACK segment, the spoofed connection established message from the second proxy node to the first proxy node, first option-data portion of the spoofed connection established message including the option- data portion of the third TCP option.

17. The system of claim 10 , wherein the instructions further cause the system to perform operations including:

receiving, at the first proxy node, a third TCP SYN segment from a fifth endpoint to establish a TCP connection with a sixtlt endpoint, the third TCP SYN segment including a first plurality of TCP options;

identifying a device make or model for the fifth endpoint based on the first plurality of TCP options included in the third TCP SYN segment; and

controlling handling of a network connection for the fifth endpoint in response to the identified device make or model.