QuestionQ100

Stateful Firewall and Screen Options

-- Exhibit --

ssg5-> get conf | include syn  
set zone untrust screen syn-flood attack-threshold 625  
set zone untrust screen syn-flood alarm-threshold 250  
set zone untrust screen syn-flood timeout 20  
set zone untrust screen syn-flood queue-size 1000  
set zone untrust screen syn-flood  
set flow syn-proxy syn-cookie  

-- Exhibit --

A host in the untrust zone sends 1000 SYN packets during one second to a host in your trust zone, with port 80 as the destination.

With reference to the exhibit, which statement describes the ScreenOS device’s behavior?

  • A It will maintain this state for all 1000 connection attempts.
  • B It will begin to drop the SYN packets.
  • C It will block further connection attempts from this host for 20 seconds.
  • D It will reply with SYN-ACK packets.
Explanation

A SYN rate of 1000 packets per second exceeds the configured SYN-flood attack threshold of 625, which activates SYN-cookie protection. SYN cookies are a stateless SYN-proxy mechanism that replies to incoming SYN packets with SYN-ACK packets containing a cookie.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!