AT3: ACK and PUSH ACK Flood
Definition
After a TCP-SYN session is established between a host and a client, ACK or PUSH ACK packets are used to communicate information back and forth between the two until the session is closed. During an ACK flood, a victim receives spoofed ACK packets at a high packet rate that fail to belong to any session within the server’s connection list. The ACK flood exhausts a victim’s server by depleting its system resources (memory, CPU, etc.) used to match these incoming packets, resulting in performance degradation or a complete server shutdown.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | None | Large | High | -- | -- | -- | -- | -- | -- |
Defense Fundamentals
The IP spoofed ACK and PUSH ACK flood is handled very similar to the TCP SYN and SYN-ACK cases:
-
Detection can be done by the source IP distribution.
-
In cases where there is a high level of suspicion of an ACK flood, the RioRey system will start dropping sample ACKs to observe proper TCP ACK retransmission. The algorithm has consideration for the fact that ACKs without data are not retransmitted.
-
Once an attack is detected, the normal defense is simply dropping all new incoming ACK and only allowing retransmitted ACKs to continue and then considering the session valid.
-
When an attacker combines a spoofed SYN or SYN-ACK with a spoofed ACK attack, our algorithm will detect and mitigate them as separate attacks.
-
This algorithm is not a persistent block, but evaluates ACKs on a packet-by-packet basis.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor/ Force On/Off) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur in Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Force On (Requires RIOS>=8.4.2): Under Auto, packets undergo two distinct phases: detection and filtering. Once an attack has been detected, filtering is executed. In Force On mode, the detection phase is skipped and all packets are automatically filtered. Due to the required resources to perform this type of filtering, Force On can only be engaged for up to 64 distinct IP addresses. You can check the number of IP addresses a device is using this mode for on the Zone Management tab under Administration->Devices. In specific cases, this mode will increase the amount of packets filtered with an increased risk of false positives. Off: No filtering or monitoring is performed. |
| Filter ACK Packets with Small Data Payload | Disabled | Enabled: Normal filtering will occur on ACK packets of all sizes. Disabled: ACK Packets that are smaller than or equal to the specified size (Small Data Payload Size) will be forwarded automatically, without going through normal filtering. |
| Small Data Payload Size | 20 (0-1500) | If the Filter ACK Packets option is disabled all ACK packets with a payload smaller than this size (in bytes) will be passed automatically. If this is set to 0 and Filter ACK Packets is Enabled, a more aggressive algorithm will be used on ACK packets without payloads. |
| Maximum duplicates (RIOS 5.6.0 or greater) | 10 | This is the maximum allowed number of duplicate ACK packets from a source IP and port to the same destination IP and port (one session) before it will be considered an attack. Turning this to 0 will disable this check. |
| Maximum allowed percentage of ACKs not matching sessions (RIOS 6.2.0 or greater) | 1 | This is the maximum percentage of ACK packets not matching existing sessions in the zone that will be allowed through. Setting this to 100 functionally disables this check, as an ACK packet will be forwarded whether or not it matches an existing session. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT3 | 1 | ACK with no data Flood Attack |
| AT3 | 2 | ACK with data Flood Attack |
| AT3 | 3 | Excessive duplicate ACK-without-data packets |
| AT3 | 4 | Excessive duplicate ACK-with-data packets |
| AT3 | 5 | ACK-with-data received after session closed (see AT8 'Drop Data for Closed Sessions') |
| AT3 | 6 | Exceeded allowed percentage of non-session ACKs |
| AT3 | 7 | Duplicate Keep Alive flood |
| AT3 | 8 | Duplicate Keep Alive flood after close |