# US 9,438,702 B2 · Techniques for protecting against denial of service attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,702 B2 - Document ID: US9438702B2 - Status: Granted - Kind: B2 - Application number: 14/679,532 - Filed: 2015-04-06 - Published: 2015-07-30 - Granted: 2016-09-06 - Earliest claimed: 2012-04-30 - Assignees: Brocade Communications Systems, Inc. - Applicants: Brocade Communications Systems, Inc. - Inventors: Mani Kancherla - Web page: https://patentgrep.com/patent/US9438702B2 ## CPC - H04L 69/166: IP fragmentation; TCP segmentation - H04L 63/1458: {Denial of Service} - H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for protecting against denial of service attacks are provided. In one embodiment, a network device can extract one or more values from a Transmission Control Protocol (TCP) ACK packet sent by a client device, where the one or more values encode TCP option information. The network device can further decode the one or more values to determine the TCP option information and embed the TCP option information into the TCP ACK packet. The network device can then forward the TCP ACK packet with the embedded TCP option information to a server. ## Claims ### Claim 1 A method comprising: extracting, by a network device, one or more values from a Transmission Control Protocol (TCP) ACK packet sent by a client device, the one or more values encoding TCP option information; decoding, by the network device, the one or more values to determine the TCP option information; embedding, by the network device, the decoded TCP option information into the TCP ACK packet; and forwarding, by the network device, the TCP ACK packet with the embedded TCP option information to a server. ### Claim 2 (depends on 1) The method of claim 1 wherein the one or more values were previously generated by the network device and transmitted to the client device via a TCP SYN-ACK packet in response to receiving a TCP SYN packet from the client device. ### Claim 3 (depends on 2) The method of claim 2 wherein the TCP option information was originally included in the TCP SYN packet. ### Claim 4 (depends on 1) The method of claim 1 wherein the decoding is performed via an algorithm that is kept secret from the client device and the server. ### Claim 5 (depends on 4) The method of claim 4 wherein the one or more values include a SYN cookie and the algorithm is a SYN cookie algorithm. ### Claim 6 (depends on 1) The method of claim 1 wherein embedding the decoded TCP option information into the TCP ACK packet comprises including the decoded TCP option information in a TCP option field of the TCP ACK packet that has a reserved type. ### Claim 7 (depends on 6) The method of claim 6 wherein the reserved type is identified by kind number 252. ### Claim 8 (depends on 6) The method of claim 6 wherein the TCP option information included in the TCP option field includes max segment size (MSS), window scale, SACK permit, and timestamp. ### Claim 9 (depends on 1) The method of claim 1 wherein embedding the decoded TCP option information into the TCP ACK packet comprises including the decoded TCP option information in a TCP/IP header field of the TCP ACK packet. ### Claim 10 (depends on 1) The method of claim 1 further comprising, subsequent to the forwarding: receiving a first TCP data packet from the client device that is destined for the server; embedding the decoded TCP option information into the first TCP data packet; and forwarding the first TCP data packet with the embedded TCP option information to the server. ### Claim 11 (depends on 1) The method of claim 1 further comprising, prior to the forwarding: embedding a security token into the TCP ACK packet. ### Claim 12 (depends on 1) The method of claim 1 wherein extracting the value from the TCP ACK packet comprises: extracting an acknowledgement value from an acknowledgement number field of the TCP ACK packet; and subtracting 1 from the acknowledgement value. ### Claim 13 A network device comprising: a processor; and a non-transitory computer readable medium having stored thereon executable program code which, when executed by the processor, causes the processor to: extract one or more values from a TCP ACK packet sent by a client device, the one or more values encoding TCP option information; decode the one or more values to determine the TCP option information; embed the decoded TCP option information into the TCP ACK packet; and forward the TCP ACK packet with the embedded TCP option information to a server. ### Claim 14 (depends on 13) The network device of claim 13 wherein the network device is an application delivery switch. ### Claim 15 A non-transitory computer readable medium having stored thereon program code executable by a processor, the program code comprising code that when executed causes the processor to: extract one or more values from a TCP ACK packet sent by a client device, the one or more values encoding TCP option information; decode the one or more values to determine the TCP option information; embed the decoded TCP option information into the TCP ACK packet; and forward the TCP ACK packet with the embedded TCP option information to a server. ### Claim 16 A method comprising: receiving, by a server, a TCP ACK packet from a network switch, wherein the TCP ACK packet originated from a client device communicatively coupled with the network switch, and wherein the TCP ACK packet includes TCP option information decoded by the network switch from one or more values originally encoded in the TCP ACK packet; identifying, by the server, the TCP ACK packet as including the decoded TCP option information; extracting, by the server, the decoded TCP option information from the TCP ACK packet; and establishing, by the server, a TCP session with the client device based on the decoded TCP option information. ### Claim 17 (depends on 16) The method of claim 16 further comprising, upon identifying the TCP ACK packet as including the decoded TCP option information: disabling SYN cookie validation of the TCP ACK packet. ### Claim 18 (depends on 16) The method of claim 16 wherein identifying the TCP ACK packet as including the decoded TCP option information comprises: identifying the TCP ACK packet as including a TCP option field that has a particular reserved type. ### Claim 19 (depends on 18) The method of claim 18 wherein the particular reserved type is identified by kind number 252. ### Claim 20 (depends on 18) The method of claim 18 wherein extracting the decoded TCP option information from the TCP ACK packet comprises: extracting the decoded TCP option information from the TCP option field. ### Claim 21 (depends on 16) The method of claim 16 wherein the decoded TCP option information includes max segment size (MSS), window scale, SACK permit, and timestamp. ### Claim 22 (depends on 19) The method of claim 19 further comprising: extracting a security token from the TCP ACK packet; and validating the TCP ACK packet as having been sent by the network switch based on the security token. ### Claim 23 A computer system comprising: a processor; and a non-transitory computer readable medium having stored thereon executable program code which, when executed by the processor, causes the processor to: receive a TCP ACK packet from a network switch, wherein the TCP ACK packet originated from a client device communicatively coupled with the network switch, and wherein the TCP ACK packet includes TCP option information decoded by the network switch from one or more values originally encoded in the TCP ACK packet; identify the TCP ACK packet as including the decoded TCP option information; extract the decoded TCP option information from the TCP ACK packet; and establish a TCP session with the client device based on the decoded TCP option information. ### Claim 24 A non-transitory computer readable medium having stored thereon program code executable by a processor, the program code comprising code that when executed causes the processor to: receive a TCP ACK packet from a network switch, wherein the TCP ACK packet originated from a client device communicatively coupled with the network switch, and wherein the TCP ACK packet includes TCP option information decoded by the network switch from one or more values originally encoded in the TCP ACK packet; identify the TCP ACK packet as including the decoded TCP option information; extract the decoded TCP option information from the TCP ACK packet; and establish a TCP session with the client device based on the decoded TCP option information. ### Claim 25 A method comprising: identifying, by a server, a received TCP ACK packet as including TCP option information; upon performing the identifying, disabling, by the server, SYN cookie validation of the TCP ACK packet; extracting, by the server, the TCP option information from the TCP ACK packet; and establishing, by the server, a TCP session based on the TCP option information.