regarding SYN-FIN floods

saimbt · ‎05-14-2005

Hi,

One of our routers was detected being vulnerable to SYN-FIN flood attack. Will this be cured by disabling "ip http server" on the router?

-Sai.

Tsasbrink · ‎05-15-2005

not realy as it will activly "fin"the syn.

You should use an accesslist to the management destination to prevent this.

saimbt · ‎05-15-2005

Hi,

is there any specific ports I should block??

i did not understand ur message.

-Sai.

Tsasbrink · ‎05-17-2005

yep to the vunrable device you should block evry port witch is not used.

deny ip any

in front of this statement you can put the permits (telnett example) witch are used for management.

permit tcp any eq 23

end the acl by permitting all allowed traffic through.

But it would be highly recommended to use a device / software witch is not vunrable as these filtest do cost performance.

What kind of device are we talking about in what situation ?