Embryonic Connection Timeout

Unanswered Question
Jul 20th, 2010
User Badges:

  • Following are the snippet from cisco documentation in "http://cisco.biz/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml"


    In this, it says embryonic connection timeout default is 0:0:30. In TCP. But with in 21 seconds after the first SYN ACK, the server will send an "RST" packet to tear down the connection attempt, and I understand that in 21 seconds, the SYN attack happens, ofcoz with multiple connection attempts the resource will not be available to accept a new connection, thus attacked.


    So what is the point in keeping a higher value (30 sec) that a normal timout of 21 seconds for embryonic connection timeout.. ??




    &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&




    In order to set the timeout for connections, embryonic connections             (half-opened) and half-closed connections, enter this command:

    hostname(config-pmap-c)#set connection {[embryonic hh[:mm[:ss]]] 
    [half-closed hh[:mm[:ss]]] [tcp hh[:mm[:ss]]]}

    Where embryonic hh[:mm[:ss] is a time between             0:0:5 and 1192:59:59. The default is 0:0:30. You can also set this value to 0,             which means the connection never times out.

    The half-closed hh[:mm[:ss] and             tcp hh[:mm[:ss] values are a time between 0:5:0 and             1192:59:59. The default for half-closed is 0:10:0 and the             default for tcp is 1:0:0. You can also set these values to 0,             which means the connection never times out.

    You can enter this command all on one line (in any order), or you             can enter each attribute as a separate command. The command is combined on one             line in the running configuration.

    • Embryonic (Half-opened) connection—An embryonic                 connection is a TCP connection request that has not finished the necessary                 handshake between source and destination.

    • Half-closed connection—Half closed connection is                 when the connection is only closed in one direction by sending FIN. However,                 TCP session is still maintained by peer.

    • Per-client-embryonic-max—The maximum number of                 simultaneous embryonic connections allowed per client, between 0 and 65535. The                 default is 0, which allows unlimited connections.

    • Per-client-max—The maximum number of                 simultaneous connections allowed per client, between 0 and 65535. The default                 is 0, which allows unlimited connections.

    • 1
    • 2
    • 3
    • 4
    • 5
    Overall Rating: 3.5 (2 ratings)
    Loading.
    Panos Kampanakis Tue, 07/20/2010 - 07:05
    User Badges:
    • Cisco Employee,

    You are saying

    But with in 21 seconds after
     the first SYN ACK, the server will send an "RST" packet to tear down 
    the connection attempt.


    I am not sure where this number was pulled from, but it could be 21s for a server, it could be 40s for another, it could be never for a third. The 30 seconds of embryonic timeout were chosen as a general default value that is low enough to not allow "too many" embryonics be established, but not break initializing connections too early either.


    Of course you can configure that limit as you showed with the "set connection" command if your server and requirements are different.


    I hope it helps.


    PK

    manuadoor Tue, 07/20/2010 - 08:01
    User Badges:

    21 sec is the default value for Windows, Please find the attachment, which I  have taken very recently for a trouble shooting.. and I have confirmed it from Windows documentation that ist 21 sec (3+6+12),


    after 1st SYN ACK , if there is no ack it will restransmit SYN ACK and reset the timer to double (6), even after no responnse it will retransmit and reset the timer to 12 (double) so 3+6+12=21 sec. After 21 sec the server will send a RST, so default 30 sec not gonna work in this case right??


    Regards,


    Manu B.

    http://manuadoor.blogspot.com

    Attachment: 
    Panos Kampanakis Tue, 07/20/2010 - 08:22
    User Badges:
    • Cisco Employee,

    If the Windows server does send a RST after its timeout then yes, the 30 seconds of ASA embryonic timeout will not kick in at all.


    PK

    manuadoor Tue, 07/20/2010 - 08:27
    User Badges:

    Could ypu confirm this, bcoz I dont think cisco missed this..

    Panos Kampanakis Tue, 07/20/2010 - 08:59
    User Badges:
    • Cisco Employee,

    It is common sense more than anything.

    If the server tears an embryonic conn before the firewall does then the timeout on the firewall does not take effect.

    Again the 30 sec value was chosen to satisfy a general scenario, not specific Windown, Linux, Solaris etc.


    PK

    manuadoor Tue, 07/20/2010 - 09:43
    User Badges:

    heheh.. But if it was based on common sense, it should be against the mininal
    value..

    Panos Kampanakis Tue, 07/20/2010 - 11:43
    User Badges:
    • Cisco Employee,

    It is all relative.


    If someone was spoofing 1000conns/second you would have 20K embryonic conns within 20 seconds. Is that enough to crash the server?...who knows...

    Now if there connection rate was 5K conns/second, is it enough to crash/overwhelm a server in 20seconds?...maybe...


    So, it is kind of relative and at what poing someone is feeling safe.


    My personal opinion is that a connection should establish in less than 5 seconds. So if it was me I would choose 10-15s. But like I said, it is all relative.


    Please rate helpful posts.


    PK

    Actions

    This Discussion