Following are the snippet from cisco documentation in "http://cisco.biz/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml"
In this, it says embryonic connection timeout default is 0:0:30. In TCP. But with in 21 seconds after the first SYN ACK, the server will send an "RST" packet to tear down the connection attempt, and I understand that in 21 seconds, the SYN attack happens, ofcoz with multiple connection attempts the resource will not be available to accept a new connection, thus attacked.
So what is the point in keeping a higher value (30 sec) that a normal timout of 21 seconds for embryonic connection timeout.. ??
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
In order to set the timeout for connections, embryonic connections (half-opened) and half-closed connections, enter this command:
hostname(config-pmap-c)#set connection {[embryonic hh[:mm[:ss]]]
[half-closed hh[:mm[:ss]]] [tcp hh[:mm[:ss]]]}
Where embryonic hh[:mm[:ss] is a time between 0:0:5 and 1192:59:59. The default is 0:0:30. You can also set this value to 0, which means the connection never times out.
The half-closed hh[:mm[:ss] and tcp hh[:mm[:ss] values are a time between 0:5:0 and 1192:59:59. The default for half-closed is 0:10:0 and the default for tcp is 1:0:0. You can also set these values to 0, which means the connection never times out.
You can enter this command all on one line (in any order), or you can enter each attribute as a separate command. The command is combined on one line in the running configuration.
Embryonic (Half-opened) connection—An embryonic connection is a TCP connection request that has not finished the necessary handshake between source and destination.
Half-closed connection—Half closed connection is when the connection is only closed in one direction by sending FIN. However, TCP session is still maintained by peer.
Per-client-embryonic-max—The maximum number of simultaneous embryonic connections allowed per client, between 0 and 65535. The default is 0, which allows unlimited connections.
Per-client-max—The maximum number of simultaneous connections allowed per client, between 0 and 65535. The default is 0, which allows unlimited connections.
