Configuration Guide Configuring TCP
8.3.3 Configuring Reset Packet Sending
Working Principle
When TCP packets are distributed to applications, if the TCP connection a packet belongs to cannot be identified, the local
end sends a reset packet to the peer to terminate the TCP connection. Attackers may use port unreachable messages to
attack the device.
Related Configuration
Configuring the Sending of TCP Reset Packets After Receiving Port Unreachable Messages
By default, TCP reset packet sending upon receiving port unreachable messages is enabled.
Run the no ip tcp send-reset command in global configuration mode to disable TCP reset packet sending upon receiving
port unreachable messages.
After this function is enabled, attackers may use port unreachable messages to attack the device.
The ip tcp not-send-rst command in version 10.x is disused but compatible in version 11.0. If this command is
executed, it will be converted to the no ip tcp send-reset
command.
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP and IPv6
TCP.
8.3.4 Configuring MSS
Working Principle
The MSS refers to the total amount of data contained in a TCP segment t excluding TCP options.
Three-way handshake is implemented through MSS negotiation. Both parties add the MSS option to SYN packets, indicating
the largest amount of data that the local end can handle, namely, the amount of data allowed from the peer. Both parties take
the smaller MSS between them as the advertised MSS.
The MSS value is calculated as follows:
IPv4 TCP: MSS = Outgoing interface MTU –IP header size (20-byte)–TCP header size (20-byte).
IPv6 TCP: MSS = IPv6 Path MTU –IPv6 header size (40-byte)–TCP header size (20-byte).
In version 10.x, the configuration applies to only IPv4 TCP. In version 11.0 or later, it applies to both IPv4 TCP and IPv6
TCP.
The effective MSS is the smaller one between the calculated MSS and the configured MSS.
If a connection supports certain options, the option length (with data offset taken into consideration) should be
deducted from an MSS value. For example, 20 bytes for MD5 digest (with data offset taken into consideration) should
be subtracted from the MSS.
Related Configuration
Configuring MSS
To Next Page
Loading...
Need help?
General
