# US 2013/0159540 A1 · Systems and methods for aggressive window probing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0159540 A1 - Document ID: US20130159540A1 - Status: Published application - Kind: A1 - Application number: 13/769,425 - Filed: 2013-02-18 - Published: 2013-06-20 - Earliest claimed: 2009-11-30 - Assignees: Citrix Systems, Inc. - Inventors: Varun Taneja; Mahesh Mylarappa; Saravanakumar Annamalaisami - Web page: https://patentgrep.com/patent/US20130159540A1 ## CPC - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1458: {Denial of Service} - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 69/163: In-band adaptation of TCP data exchange; In-band control procedures - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present application is directed towards systems and methods for aggressively probing a client side connection to determine and counteract a malicious window size attack or similar behavior from a malfunctioning client. The solution described herein detects when a connection may be under malicious attach via improper or unusual window size settings. Responsive to the detection, the solution described herein will setup probes that determine whether or not the client is malicious and does so within an aggressive time period to avoid the tying up of processing cycles, transport layer sockets and buffers, and other resources of the sender. ## Claims ### Claim 1 A system for probing a connection of a client, the system comprising: a device intermediary to a client and a server, the device configured to establish a first transport layer connection with the client responsive to receiving a request by the client to establish a transport layer connection with the server, the client identifying a window size for the first transport layer connection less than a maximum segment size; and wherein the device is configured to drop packets sent from the client identifying that the window size is still less than the maximum segment size in response to a window probe, and upon determining that the client has not increased the window size responsive to a predetermined number of window probes, the device is configured to disestablish the first transport layer connection. ### Claim 2 (depends on 1) The system of claim 1, wherein the device is configured to establish a first transport layer connection with the client without linking the first transport layer connection to a second transport layer connection between the device and the server. ### Claim 3 (depends on 2) The system of claim 2, wherein the device is configured not to establish the second transport layer connection between the device and the server responsive to the request by the client. ### Claim 4 (depends on 1) The system of claim 1, wherein the device is configured to transmit the predetermined number of window probes over a predetermined time period. ### Claim 5 (depends on 1) The system of claim 1, wherein the dropped packets comprise an acknowledgement packet identifying the window size is less than a predetermined number of bytes. ### Claim 6 (depends on 1) The system of claim 1, wherein the window probe includes at least one data byte past an end of the window. ### Claim 7 (depends on 1) The system of claim 1, wherein the device is configured to determine that a packet from the client received responsive to one of the window probes has a sequence number out of order. ### Claim 8 (depends on 8) The system of claim 8, wherein the device is configured to drop the packet. ### Claim 9 (depends on 1) The system of claim 1, wherein the device is configured to determine that the client maintains sending the window size less than the maximum segment size and disestablish the first transport layer connection. ### Claim 10 (depends on 1) The system of claim 1, wherein the device is configured to determine that the client has not increased the window size above a predetermined threshold and to disestablish the first transport layer connection. ### Claim 11 A system for probing a client, the system comprising: a device intermediary to plurality of clients and one or more servers, the device configured to maintain in a queue client requests to establish a connection to a server responsive to a number of client requests exceeding a predetermined number, wherein one or more of the plurality of client requests identifies a window size of zero; wherein the device is configured to transmit a keep alive probe to a client responsive to determining that the number of client requests in the queue exceeds a predetermined threshold; and wherein the device is configured to disestablish a transport layer connection with the client responsive to the client maintaining the window size of zero in response to the keep alive probe. ### Claim 12 (depends on 11) The system of claim 11, wherein the device is configured to transmit a first keep alive probe to a first client corresponding to a first client request in the queue, the first client request identifying a first window size of zero. ### Claim 13 (depends on 11) The system of claim 11, wherein the predetermined threshold comprises a number of connections that the server can accept. ### Claim 14 (depends on 11) The system of claim 11, wherein the device is configured to receive a corrective acknowledgement packet from the first client, the corrective acknowledgement packet maintaining the first window size of zero, and the device is further configured to disestablish a first transport layer connection from the intermediary device to the first client responsive to the first window size of the corrective acknowledgement packet. ### Claim 15 (depends on 11) The system of claim 11, wherein the device is configured not to establish a transport layer connection with the server for at least one of the plurality of client requests. ### Claim 16 (depends on 11) The system of claim 11, wherein the device is configured not to link any of the transport layer connections with the clients to a transport layer connection that the device has with the server. ### Claim 17 (depends on 11) The system of claim 11, wherein the device is configured to receive a corrective acknowledgement packet from a second client, the corrective acknowledgement packet identifying a second window size greater than zero. ### Claim 18 (depends on 17) The system of claim 17, wherein the device is configured to link a transport layer connection between the device and the second client to a transport layer connection between the device and the server responsive to the second window size being greater than a maximum segment size ### Claim 19 (depends on 11) The system of claim 11, wherein the device is configured to transmit keep alive probes to each of the plurality of clients having a request in the queue. ### Claim 20 (depends on 19) The system of claim 19, wherein the device is configured to disestablish transport layer connections to those clients that respond to the keep alive probes with a window size less than a predetermined size.