# US 11,909,762 B2 · Thwarting SYN flood DDOS attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,762 B2 - Document ID: US11909762B2 - Status: Granted - Kind: B2 - Application number: 17/398,708 - Filed: 2021-08-10 - Published: 2023-02-16 - Granted: 2024-02-20 - Earliest claimed: 2021-08-10 - Assignees: Mellanox Technologies, Ltd. - Applicants: Mellanox Technologies, Ltd. - Inventors: Andrei Vesnovaty; Alexander Vesker; Mohammad Sammar - Web page: https://patentgrep.com/patent/US11909762B2 ## CPC - H04L 63/1458: {Denial of Service} - H04L 7/0008: {Synchronisation information channels, e.g. clock distribution lines} - H04L 69/326: in the transport layer [OSI layer 4] (H04L69/16 takes precedence) - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for efficiently thwarting syn flood DDoS attacks on a target server including a CPU, the system comprising: network controller hardware having steering capability; and a software application to create and to configure initial steering object/s which define a steering configuration of the network controller and monitor at least one opened connection to the server, including updating the steering configuration responsive to establishment of at least one connection to the server, wherein the network controller hardware's steering capability is used to provide a SYN cookie value used for said thwarting, and to send at least one packet, modified, to the packet's source. ## Claims ### Claim 1 A system for efficiently thwarting syn flood DDoS attacks on a target server including a CPU, the system comprising: a. network controller hardware having a steering capability; and b. a software application to create and to configure initial steering object's which define a steering configuration of the network controller and monitor at least one opened connection to the server, including updating the steering configuration responsive to establishment of at least one connection to the server, wherein the network controller hardware's steering capability is used to provide a SYN cookie value used for said thwarting, and to send at least one packet, modified, to the packet's source, without wasting target server CPU cycles on crypto hash calculation per SYN and ACK packets in real time, and without devoting per-packet target server CPU effort thereto in real time, and wherein the software application's creation and configuration of said initial steering object/s includes the following operations: for TCP SYN/ACK packets, creating steering objects to look up a value over packet headers; for at least one packet having a header, creating steering objects to reverse the packet's header and to send the packet back to the packet's source; waiting for, and tracking, all incoming new connections; waiting for, and tracking, all stalled or closed connections; at least once, refreshing a created steering object to ensure randomness; configuring at least one steering object/s for allowed established connections. ### Claim 2 (depends on 1) A system according to claim 1 wherein said initial steering object/s comprise at least one pre-configured, periodically updated steering table/s and wherein said software application creates and configures said initial steering object/s by including, in the steering table, at least one SYN cookie value which is computed by the network controller hardware's steering capability, and which is used by at least one SYN packet to generate SYNACK. ### Claim 3 (depends on 1) A system according to claim 1 wherein said initial steering object/s comprises at least one pre-configured, periodically updated steering table/s, and wherein said software application creates and configures said initial steering object/s by including, in the steering table, at least one SYN cookie value which is computed by the network controller hardware's steering capability and which is used by at least one ACK packet having sequence match predefined values, to validate the ACK packet's sequence match predefined values and to generate SYNACK. ### Claim 4 (depends on 1) A system according to claim 1 wherein at least one final ACK establishment packet is verified using a processor of the network controller, thereby to perform SYN cookie verification without wasting target server CPU cycles, by using only hardware without software calculation. ### Claim 5 (depends on 1) A system according to claim 1 wherein a processor of the network controller uses said steering capability to map a hash over a field. ### Claim 6 (depends on 5) A system according to claim 5 wherein the network controller hardware uses said steering capability to compute a CRC32 hash over a IP 5tuple field. ### Claim 7 (depends on 1) A system according to claim 1 wherein the network controller hardware uses said steering capability for redirecting at least one packet to a different location by modifying said at least one packet. ### Claim 8 (depends on 7) A system according to claim 7 wherein said modifying comprises swapping the packet's source and destination addresses. ### Claim 9 (depends on 1) A system according to claim 1 wherein the network controller hardware uses said steering capability to filter at least one packet over at least one specific packet field. ### Claim 10 (depends on 9) A system according to claim 9 wherein a processor of the network controller uses said steering capability to filter at least one packet having a TCP sequence number which matches at least one specific TCP sequence number. ### Claim 11 (depends on 1) A system according to claim 1 wherein said connections comprise TCP connections, wherein at least one packet has a header which comprises a 5tuple TCP header and wherein said SYN and ACK packets comprise TCP SYN and ACK packets. ### Claim 12 (depends on 11) A system according to claim 11 wherein the network controller hardware handles at least one packet arriving via port P as follows: Looks up a hash over a received SYN 5tuple TCP header; Sets the packet's TCP sequence to a stored value found in a SYN Cookie lookup which looks up said SYN cookie value; Reverses the packet's source and destination fields; Sends a SYN ACK packet over the same port P; Verifies a TCP SYN ACK packet and passes the TCP SYN ACK packet to the software application. ### Claim 13 (depends on 1) A system according to claim 1 wherein the network controller hardware comprises a SmartNIC. ### Claim 14 (depends on 1) A system according to claim 1 wherein said software application is deployed at user level. ### Claim 15 (depends on 1) A system according to claim 1 wherein said software application is deployed at kernel level. ### Claim 16 (depends on 1) A system according to claim 1 which is incorporated as an anti-DDoS solution in a server. ### Claim 17 (depends on 1) A system according to claim 1 which is incorporated as a library/component in an SDK. ### Claim 18 A method for efficiently thwarting syn flood DDoS attacks, the method comprising: providing, in a network controller, hardware having packet a steering capability; providing a software application to create and to configure initial steering object/s which define a packet steering configuration of the network controller and monitor all opened connections, including updating the packet steering configuration each time a connection is established, wherein the software application's creation and configuration of said initial steering object/s includes the following operations: for TCP SYN/ACK packets, creating steering objects to look up a value over packet headers; for at least one packet having a header, creating steering objects to reverse the packet's header and to send the packet back to the packet's source; waiting for, and tracking, all incoming new connections; waiting for, and tracking, all stalled or closed connections; at least once, refreshing a created steering object to ensure randomness; and configuring at least one steering object/s for allowed established connections; and thwarting SYN flood DDoS attacks by computing a SYN cookie value used for said thwarting, without wasting target server CPU cycles on crypto hash calculation per SYN and ACK packets in real time, thus without devoting per-packet target server CPU effort thereto in real time, including using the steering capability to provide the SYN cookie value, and to at least one packet to the packet's source, rather than resorting to software to perform crypto hash calculation per SYN and ACK packets in real time.