AT7: Fake Session
Definition
This attack generates a forged SYN, multiple ACK and then one or more FIN/RST packets. These packets together appear to look like a valid TCP session from one direction. Most networks implement asymmetric routing techniques, in which incoming packets and outgoing packets travel on different links to optimize cost and performance. In turn, modern network defense tools are designed to monitor single directional traffic and do not rely on the return traffic from the server. This attack fakes a complete TCP communication and is designed to fool new defense tools that only monitor incoming traffic to the network.
There are two variations of this attack: the first variation generates multiple forged SYNs, then multiple ACKs, followed by one or more FIN/RST packets, and the second variation skips the initial SYN, and starts by generating multiple ACKs, followed by one or more FIN/RST packets. The low TCP-SYN rate makes the attack harder to detect than a typical SYN Flood while achieving the same result: the depletion of the victim’s system resources.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | None | Large | Low | -- | -- | -- | -- | -- | -- |
Defense Fundamentals
RioRey's approach to Fake Session defense is to break the attack into its components, making sure that each component has a tool capable of addressing a specific aspect of the attack. Therefore, a Fake Session attack, depending on its session rates, skills in forging successive session packets, etc., may result in RioRey reporting the attack as multiple attacks or different attacks.
For example, a truly spoofed IP Fake Session attack may be reported as AT1 (SYN), AT3 (ACK) and AT5 (FIN) attacks at the same time. However, if the attacker reduces the source IP pool to avoid AT 1 detection, it will result in triggering an AT7 Fake Session attack. Therefore, if an attacker attempts to reduce the source address pool used in an attack, they would have to repeat more sessions from the same IP, thus triggering this algorithm.
We specifically address the rate of attempted connection from a source IP. Since we've already addressed well distributed attacks with lower rates of spoofed IPs, this algorithm focuses on when the attacker repeats session attempts at a very high rate from a single source IP. All session rate calculations are based on source/destination IP pairs. Since filtering affects only this source/destination pair there will be no collateral damage to a good source IP requesting a session from a different destination IP.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
You can hit Clear Filter List to remove all IPs from the filter list for this attack type. This is equivalent to running a Clear for all IPs under this attack type in Clear Filter List.
If you are changing filter settings, it is recommended you Clear Filter List after you have updated your settings to prevent addresses from getting blocked again before the new settings take effect.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |