Slow connection detection and aggressive aging.This section includes the following topics: Thus, a 1 Gbps SYN flood will generate 2 Gbps reverse traffic.)įigure 14: SYN Flood Mitigation Mode-SYN Retransmission (This method generates 2 responses for every SYN. Fortinet recommends this option if you have enough bandwidth in the reverse direction of the attack. If the client’s response indicates that the source is not spoofed, FortiDDoS allows the connection and adds the source to the legitimate IP address table.

The system determines whether the source is not spoofed based on the client’s response. FortiDDoS sends the client two ACK packets: one with a correct ACK number and another with a wrong number. Traffic to other destinations is not subject to the tests.įigure 12 illustrates the ACK Cookie mitigation mode option. syn-per-dst: When the per-destination limits are exceeded for a particular destination, the SYN flood mitigation mode tests are applied to all new connection requests to that particular destination.syn: When total SYNs to the subnet exceeds the threshold, the SYN flood mitigation mode tests are applied to all new connection requests.The SYN flood mitigation mode behavior applies only when FortiDDoS has detected a SYN flood with either of the following thresholds: FortiDDoS takes a guarded approach to other SYN packets, and they are processed according to the configured SYN flood mitigation mode option:.New SYN packets coming from addresses in the LIP table are presumed legitimate and are allowed.In this mode, the system acts as a proxy for TCP connection requests and uses the LIP table to validate new connections: When FortiDDoS detects a SYN flood attack, it enters SYN flood mitigation mode. Entries in the LIP expire after 5 minutes. This is called the legitimate IP address (LIP) table. To prepare for SYN flood attacks, FortiDDoS maintains a table of IP addresses that have completed a three-way handshake. Figure 11: Half-Open TCP Connection SYN Flood Attack

Ensure syn