Packet Filtering of the Transport Layer Protocols

Packet Filtering of the Transport Layer Protocols

We will now explain some of the security issues involved in the filtering
of TCP, UDP and ICMP, the transport layer protocols.


Filtering of TCP
We know that TCP is a bi-directional protocol, which guarantees that
the destination will receive all the application data, in the order it was
sent, and without any duplicates. To safeguard this reliability, TCP uses
a three-way handshake when setting up and closing a connection. Each
time packets are sent, the acknowledgement segment (ACK) will enable
’positive acknowledgement’ and ’flow control’, by telling the sender
how much data has been received, and how much more the receiver
can accept.
Establishing a Connection
Now, in order to set up a connection, the sender will send a segment
with the synchronize sequence numbers (SYN) bit set. This is the only
time during the whole connection that the ACK bit is not set. This
feature allows easy blocking of a TCP connection with a packet filter:
one only has to block the first packet of the connection (the one which
has the ACK bit not set in the TCP header), and all other packets will
subsequently be discarded, since TCP would rather kill an incomplete
connection than compromise the reliability it guarantees.
SYN-flooding
One rather annoying problem is a denial of service attack in the form of
SYN-flooding: attackers can send enormous amounts of SYN-requests
to a firewall, that is listening on its TCP ports and trying to open a
connection for each and every one of those requests by sending back an
SYN/ACK. However, by giving spoofed IP source addresses, no
response will ever come back, and resources will be wasted until a
timeout occurs. Despite assurances by some, this problem has not been
completely resolved yet.