> Source: [sk104028](https://support.checkpoint.com/results/sk/sk104028)

# sk104028 - DISA STIG Compliance for half-open TCP connections

| Property | Value |
|----------|-------|
| Solution ID | sk104028 |
| Date Created | 2015-01-06 |
| Last Modified | 2015-01-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) requirements stipulate closing of half-open TCP connections within 10 seconds
* The sensor positioned to protect servers in the server farm or DMZ must provide protection from DoS SYN Flood attacks by dropping half-open TCP sessions.

## Cause

SYN flood sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for a packet in response from the sender address.   
However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends. If the server farm is being monitored by an IDS as opposed to an IPS that can block traffic inline, the following alternatives can be implemented: Upon detection of a SYN flood attack; the IDS can dynamically push (or remotely configure) an ACL unto the upstream router; or multi-layer switch that can serve as the blocking device for the TCP SYN flood attack. Configure TCP Intercept on the server farm's first hop router, MLS, or firewall that is controlling access to the server farm subnet (VLAN).

Source: [SRG-NET-000244-IDPS-000230.](http://www.stigviewer.com/stig/idps_security_requirements_guide_srg/2012-03-08/finding/SRG-NET-000244-IDPS-000230)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content