防火墙防御SYN Flood攻击机制研究

Research of Firewall Defense Mechanism for SYN Flood Attack

为了有效防御SYN Flood攻击,同时降低防火墙的压力,提出一种防火墙代理的防御SYN Flood攻击机制,并在Linux平台上通过增加防火墙过滤钩子块和修改服务器协议栈进行了实现。该机制是对SYN中继的改进,避免了防火墙与服务器之间的三次握手过程和修改TCP数据包的序列号及确认号的操作。实验结果表明,该机制能够大幅降低防火墙资源消耗,同时具有更好的防御效果。

To defense SYN flood attacks effectively and reduce the pressure of firewall, the defense SYN flood attack mechanism based on firewall proxy was introduced. It was implemented by adding firewall filter hook block and modifying the server protocol stack based on Linux platform. It was the improvement of the SYN relay, which avoided the three - way handshaking between the firewall and the server, and modifying the serial number and the confirmation number of the TCP packets. Experimental results showed that the mechanism based on the firewall proxy can consume fewer resources and defense more attacks.