AT8: Session Attack
Definition
A valid TCP-SYN session is generated between a bot and a victim. Once the session is established, the attacker manipulates the session in any number of ways to maximally deplete the victim's resources. This includes setting excessively small windows to make the session take longer, setting excessively high timeouts but not sending any data to hold the session open longer, or simply creating a lot of empty sessions preventing normal traffic from using those resources.
These attacks exhaust the victim’s server by depleting its system resources (memory, CPU, etc.) used to track session behavior, resulting in performance degradation or a complete server shutdown. Session Attacks are non-spoofed: the source IP is the actual public IP of the attacker bot, and the source IP range is equal to the number of bots used in the attack.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | Yes | Small | Variable | Small | -- | -- | Very Low to Very High | Very Short to Very Long | -- |
Defense Fundamentals
The RioRey algorithm contains a number TCP session measurements and tracking capabilities. These analytics are used to decide if a session is proper or not. This allows the device to track zero window sessions, improperly open/closed sessions etc.
| Description | Filter Sensitivity LEVEL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 OFF | 1 | 2 | 3 | 4 | 5* | 6 | 7 | 8 | 9 | 10 | |
| Block Excessive Idle Sessions | NA | Disabled | Disabled | Disabled | Disabled | Disabled* | Enabled | Enabled | Enabled | Enabled | Enabled |
| Block excessive sessions closed by RST | NA | Disabled | Disabled | Disabled | Disabled | Disabled* | Enabled | Enabled | Enabled | Enabled | Enabled |
| Block Excessive Duplicate ACKs | NA | Disabled | Disabled | Disabled | Disabled | Disabled* | Enabled | Enabled | Enabled | Enabled | Enabled |
| Attacker IP Block time (minutes) | NA | 10 | 15 | 30 | 30 | 30* | 60 | 240 | 480 | 960 | 1440 |
| Drop Data For Closed Sessions | NA | Disabled | Disabled | Disabled | Disabled | Disabled* | Enabled | Enabled | Enabled | Enabled | Enabled |
| Small Data Size (bytes) | NA | 1 | 2 | 3 | 4 | 4* | 5 | 10 | 25 | 50 | 100 |
| Good No Data Session Threshold (packets) | NA | 2 | 2 | 2 | 2 | 2* | 5 | 25 | 50 | 100 | 127 |
| Dribbling Data Attack Threshold (packets) | NA | 0 | 126 | 50 | 50 | 50* | 16 | 10 | 10 | 5 | 5 |
| Good Short Session Threshold (packets) | NA | 0 | 1 | 1 | 2 | 2* | 2 | 5 | 10 | 10 | 15 |
| Small Window Size (bytes) | NA | 1 | 1 | 5 | 5 | 5* | 50 | 250 | 500 | 1000 | 10,000 |
| Small Window Attack Threshold (packets) | NA | 0 | 254 | 100 | 75 | 50* | 5 | 5 | 3 | 2 | 1 |
| Bad Session Victim Threshold (sessions) | NA | 5000 | 1000 | 100 | 75 | 50* | 10 | 5 | 5 | 2 | 2 |
| Bad Session Victim Threshold (percentage) | NA | 99 | 99 | 95 | 90 | 85* | 75 | 50 | 50 | 33 | 33 |
| Bad Session Attacker Threshold (sessions) | NA | 5000 | 1000 | 100 | 75 | 50* | 10 | 5 | 5 | 2 | 2 |
| Bad Session Attacker Threshold (percentage) | NA | 99 | 99 | 95 | 90 | 85* | 75 | 50 | 50 | 33 | 33 |
| Aggressive Victim/Attacker Detection | NA | Disabled | Disabled | Disabled | Disabled | Disabled* | Disabled | Enabled | Enabled | Enabled | Enabled |
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
You can hit Clear Filter List to remove all IPs from the filter list for this attack type. This is equivalent to running a Clear for all IPs under this attack type in Clear Filter List. If you are changing filter settings, it is recommended you Clear Filter List after you have updated your settings to prevent addresses from getting blocked again before the new settings take effect.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Filter sensitivity | Level 5 (1-10) | This feature allows the user to adjust the sensitivity level of the filter for Session attacks. The recommended default setting is level 5. To reduce filter sensitivity, lower the setting number. The higher the setting, the more sensitive the filter becomes. Due to the aggressiveness of the setting, Level 10 is liable to drop some good traffic. Alter the sensitivity settings gradually as needed. |
| Show advanced controls | Disabled | Enabling this control opens up all of the advanced controls for AT8 (listed below). By default, the controls will populate at their settings for the currently set filter sensitivity level. The advanced controls require careful configuration in order to work correctly. They should only be adjusted after direct consultation with RioRey. |
| Block Excessive Idle Sessions | Disabled | If enabled, this control will consider source IPs that open sessions but don't send any data within 180 seconds to be an attacker. Violations of this control are reported as Subtype 1. |
| Block excessive sessions closed by RST (RIOS 6.2.0 or greater) | Disabled | If enabled, this control will also include sessions closed by RST (as opposed to just by FIN) for excessive session calculations. Violations of this control are reported as Subtype 7. |
| Block Excessive Duplicate ACKs | Disabled | If enabled, this value will block excessive duplicate ACK packets that exceed the tests for AT 3. Since blocked AT8 attackers are added to the Filter List, this will effectively stop all traffic from the attacker to the victim for the duration set under Attacker IP Block Time. Subtype 6 is reported against the victim if IPs sending excessive duplicate ACK packets are added to the Filter List. |
| Attacker IP Block Time | 30 | This is the number of minutes a detected attacker will be blocked from sending traffic to a declared victim. Attacker source IPs will be added to the Filter List. |
| Drop Data For Closed Sessions | Disabled | If enabled, this control will drop data packets after the session has been closed. Violations of this will be tracked under AT3 Subtype 5 rather than putting the source on the filter list, to prevent excessive drops of traffic. |
| Small Data Size (bytes) | 4 | This value sets the "Small Data Size" used by the algorithm. TCP ACK data packets with a payload of this size (in bytes) or smaller will be considered "small data" packets. |
| Good No Data Session Threshold (packets) | 2 (1-126) | This value sets the threshold of ACK packets received above which a session, with no data packets received, will be considered good. Violations of this control are reported as Subtype 2. |
| Dribbling Data Attack Threshold (packets) | 50 (0-126) | This value sets the threshold of "small data" ACK packets received above which a session, with no "large data packets (i.e. greater than Small Data Size)" packets received, will be considered bad. A value of 0 will disable this test. Violations of this control are reported as Subtype 4. |
| Good Short Session Threshold (packets) | 2 (0-14) | This values sets the threshold of "large data packets (i.e. greater than Small Data Size)", sent or received, below which a session will be considered bad. Violations of this control are reported as Subtype 3. |
| Small Window Size (bytes) | 5 (1-10,000) | This value sets the "Small Window Size" used by the algorithm. ACK packets with a window size of this value or smaller will be considered advertising a "small window". |
| Small Window Attack Threshold (packets) | 50 (0-254) | This value sets the threshold of "small window" advertisements, in a session,with no "large data packets (i.e. greater than Small Data Size)" sent, above which a session will be considered bad. A value of 0 will disable this test. Violations of this control are reported as Subtype 5. |
| The following four controls are calculated for each subtype (referenced below) against total session traffic. At normal or reduced levels of sensitivity, this helps reduce false positives. It also means it will be less likely to filter multiple simultaneous attacks due to the percentage requirements, since these controls are calculated for each subtype independently against all session traffic (including the other subtypes). If you suspect multiple attack techniques are being used, either raise sensitivity or enable Aggressive Victim/Attacker Detection, which will trigger filtering on traffic meeting the count thresholds instead of both the count and percentage thresholds. | ||
| Bad Session Victim Threshold (sessions) | 50 (2-10,000) | This is the minimum number of bad sessions that must be detected before a destination IP will be declared a victim. If Aggressive Detection is enabled, meeting this threshold is enough to declare a victim, otherwise the percentage of bad sessions specified by Bad Session Victim Threshold (percentage) must also be met. |
| Bad Session Victim Threshold (percentage) | 85 (1-100) | This is the minimum percentage of bad sessions to a destination IP before a destination IP will be declared a victim. If Aggressive Detection is enabled, meeting this threshold is enough to declare a victim, otherwise the count of bad sessions specified by Bad Session Victim Threshold (sessions) must also be met. |
| Bad Session Attacker Threshold (sessions) | 50 (2-10,000) | This is the minimum number of bad sessions that must be detected from a source IP to a victim before it will be considered an attacker. If Aggressive Detection is enabled, meeting this threshold is enough to declare an attacker, otherwise the percentage of bad sessions specified by Bad Session Attacker Threshold (percentage) must also be met. |
| Bad Session Attacker Threshold (percentage) | 85 (1-100) | This is the minimum percentage of bad sessions from a source IP to a victim before it will be considered an attacker. If Aggressive Detection is enabled, meeting this threshold is enough to declare an attacker, otherwise the count of bad sessions specified by Bad Session Victim Threshold (percentage) must also be met. |
| Aggressive Victim/Attacker Detection | Disabled | When disabled, both the minimum session count and percentage thresholds (outlined above) must be met to declare an attacker or a victim. If enabled, meeting either the count or the percentage threshold is sufficient to declare an attacker or a victim. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT8 | 1 | Excessive Idle Sessions- Session opened but not closed, with or without any data exchanged. |
| AT8 | 2 | Excessive Sessions With No Data and Few ACK Packets- Open or closed session with no data exchanged and zero or few ACK packets. |
| AT8 | 3 | Excessive Small Data Sessions- Open or closed session with few data packets sent and received. |
| AT8 | 4 | Slow Data Rate Attack- Open or closed session where the attacker dribbles data to server without sending any large data packet. |
| AT8 | 5 | Small TCP Window Attack- Open or closed session where the attacker advertises a small receive window forcing the server to stall. |
| AT8 | 6 | Excessive Sessions With Duplicate ACK Packets- Excessive duplicate ACK packets from an IP which will be blocked if the destination is a victim. |
| AT8 | 7 | Excessive Sessions Closed by RST |