Mitigating tcp syn ddos attacks using tcp reset

A method for recognizing network devices as trusted, the method comprising:

• receiving, by a network appliance, a request from a network device to establish a data connection with a server;
• determining, by the network appliance, that the network device is trusted;
• responsive to the determination, whitelisting, by the network appliance, the network device for a predetermined period of time;
• and
• establishing, by the network appliance, the data connection between the network device and the server.

A system for recognizing network devices as trusted, the system comprising:

• a network module configured to:
• receive a request from a network device to establish a data connection between the network device and a server;
• and
• establish the data connection between the network device and the server based on a determination that the network device is trusted;
• a storage device configured to store a whitelist associated with a plurality of trusted network devices;
• and
• a processor configured to:
• determine that the network device is trusted;
• based on the determination, associate the network device with the whitelist for a predetermined period of time;
• wherein the determining, by the processor, that the network device is trusted includes:
• receiving, by the network module, from the network device, an initial synchronization (SYN) request to establish a Transmission Control Protocol (TCP) session;
• generating, by the processor, a SYN cookie;
• transmitting, by the network module, a SYN acknowledgement (ACK) including the SYN cookie to the network device;
• responsive to the SYN ACK, receiving from the network device, by the network module, a network device ACK;
• determining, by the processor, that the network device ACK includes the SYN cookie;
• and
• based on the determining, validating, by the processor, authenticity of the SYN cookie;
• and
• wherein the establishing, by the network module, the data connection by the network module between the network device and the server includes:
• based on the determination that the network device is trusted, transmitting, by the network module, a TCP reset command to the network device, the TCP reset command instructing the network device to terminate the TCP session and to start a new TCP session;
• receiving, by the network module, from the network device, a further SYN request to establish the new TCP session;
• determining, by the processor, that the network device is whitelisted;
• and
• based on the determination, establishing, by the network module, a trusted data connection between the network device and the server for the predetermined period of time.