2

I have an HP ProCurve 2910al (J9146A) and I am being requested to drop connections or timeout connections with half-open TCP connections. I am having trouble finding commands or even understanding what half-open TCP connections are. My ports on the switch are set with port-security to specific MAC addresses. What commands can I use on my switch to drop or timeout half-open TCP connections?

1
  • That is not something you do on a switch. The switch will be ignorant about one side or the other of the TCP connection crashing or resetting. This is something normally handled in the hosts, and there are some firewalls that can deal with the situation by timing out a TCP connection.
    – Ron Maupin
    May 1, 2018 at 17:29

1 Answer 1

3

Half-open TCP connections are connections that have not completed the three-way handshake (yet). For inbound connections, a SYN packet has been reveceived without an answer to the SYN/ACK reply.

As a layer-3 switch, the 2910al is a stateless router. Therefore it has no knowledge about half-open or completed connections that is has routed (or even switched).

If you want to defend the switch itself against DoS attacks you should move the management to a VLAN that normal users can't connect on. Additionally, you can use ACLs to deny unwanted packets as soon as they enter an edge/access port. Furthermore, you might want to disable the web interface if it's being attacked.

If you post the (sanitized) configuration and a better description of the actual problem we can provide more detailed help.

2
  • 1
    He started a discussion on Network Engineering Chat. I gave him the part of the RFC, and explained that he needs a device like a firewall that maintains TCP state.
    – Ron Maupin
    May 1, 2018 at 17:37
  • @RonMaupin is right. He gave me some understanding and I have enacted stronger Port Security and authentication which should help. But since we are using this as a Layer 2 switch without a Layer 3 device this requirement is a moot point. But this answer explains the understanding a lot better. Thanks.
    – JukEboX
    May 7, 2018 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.