Security Best Practice: TCP Window Size Enforcement

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Network Security and select TCP.
2. In the right pane, double-click the TCP Window Size Enforcement protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

Note that administrators are able to edit the IP/IP Ranges that will be inspected by this defense. In order to do so, follow these steps:
1. Establish an SSH connection to the Management machine.
2. Enter the $FWDIR/conf directory (cd).
3. Edit the file “updates.def” using any text editor.
4. Search for “tcpstress_inspect_list”. Edit the tcpstress_inspect_list with the desired IP addresses. The tcpstress_inspect_list is a static list of IP's that are inspected by this defense. By default it is set to inspect all IP ranges from 0.0.0.0 to 255.255.255.255. This is the default code:
tcpstress_inspect_list = {<0.0.0.0, 255.255.255.255>};
If you wish to edit this list to protect two servers (IP: 1.2.3.4 and IP: 10.20.30.40), you will need to change the code as follows:
tcpstress_inspect_list = {<1.2.3.4> , <10.20.30.40>};
You can also include an IP Range. For example, to protect an IP Range from 1.1.1.1 to 3.3.3.3, you should edit the list as follows:
tcpstress_inspect_list = {<1.1.1.1 , 3.3.3.3>}; 
5. Once the editing is finished, save the list. This process has to be repeated after each IPS update.
6. Install Policy on the modified module.

For protection against the CVE-2009-1925 vulnerability:
1. In the IPS tab, click Protections > By Protocol > Network Security > TCP.
2. In the right pane, double-click the SYN Attack protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TCP Enforcement Violation
Attack Information: Window size enforcement

How Can I Protect My Network?
1. In the SmartDefense tab, click Network Security > TCP > TCP Window Size Enforcement.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

Note that administrators are able to edit the IP/IP Ranges that will be inspected by this defense. In order to do so, follow these steps:
1. Establish an SSH connection to the Management machine.
2. Enter the $FWDIR/conf directory (cd).
3. Edit the file “updates.def” using any text editor.
4. Search for “tcpstress_inspect_list”. Edit the tcpstress_inspect_list with the desired IP addresses. The tcpstress_inspect_list is a static list of IP's that are inspected by this defense. By default it is set to inspect all IP ranges from 0.0.0.0 to 255.255.255.255. This is the default code:
tcpstress_inspect_list = {<0.0.0.0, 255.255.255.255>};
If you wish to edit this list to protect two servers (IP: 1.2.3.4 and IP: 10.20.30.40), you will need to change the code as follows:
tcpstress_inspect_list = {<1.2.3.4> , <10.20.30.40>};
You can also include an IP Range. For example, to protect an IP Range from 1.1.1.1 to 3.3.3.3, you should edit the list as follows:
tcpstress_inspect_list = {<1.1.1.1 , 3.3.3.3>}; 
5. Once the editing is finished, save the list. This process has to be repeated after each SmartDefense update.
6. Install Policy on the modified module.

For protection against the CVE-2009-1925 vulnerability:
1. In the SmartDefense tab, click Network Security > TCP > SYN Attack Configuration.
2. In the configuration pane, under Settings, check the "Activate SYN Attack protection" box.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TCP Enforcement Violation
Attack Information: Window size enforcement

How Can I Protect My Network?
1. In the SmartDefense tab, click Network Security > TCP > TCP Window Size Enforcement.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

Note that administrators are able to edit the IP/IP Ranges that will be inspected by this defense. In order to do so, follow these steps:
1. Establish an SSH connection to the Management machine.
2. Enter the $FWDIR/conf directory (cd).
3. Edit the file “updates.def” using any text editor.
4. Search for “tcpstress_inspect_list”. Edit the tcpstress_inspect_list with the desired IP addresses. The tcpstress_inspect_list is a static list of IP's that are inspected by this defense. By default it is set to inspect all IP ranges from 0.0.0.0 to 255.255.255.255. This is the default code:
tcpstress_inspect_list = {<0.0.0.0, 255.255.255.255>};
If you wish to edit this list to protect two servers (IP: 1.2.3.4 and IP: 10.20.30.40), you will need to change the code as follows:
tcpstress_inspect_list = {<1.2.3.4> , <10.20.30.40>};
You can also include an IP Range. For example, to protect an IP Range from 1.1.1.1 to 3.3.3.3, you should edit the list as follows:
tcpstress_inspect_list = {<1.1.1.1 , 3.3.3.3>}; 
5. Once the editing is finished, save the list. This process has to be repeated after each SmartDefense update.
6. Install Policy on the modified module.

For protection against the CVE-2009-1925 vulnerability:
1. In the SmartDefense tab, click Network Security > TCP > SYN Attack Configuration.
2. In the configuration pane, under Settings, check the "Activate SYN Attack protection" box.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TCP Enforcement Violation
Attack Information: Window size enforcement

How Can I Protect My Network?

Protection for CVE-2009-4609:
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Intelligence > TCP, and select the Bad Header Length protection group.
3. Click TCP Window Error (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

Protection for CVE-2009-1926:

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Intelligence > TCP, and select the Bad header length protection group.
3. Click TCP Window Error (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

In addition to enabling the protection above, increase the paranoia threshold:

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Intelligence > TCP, and select the Bad header length protection group.
3. Click TCP Window Error (IPS-1 NGX R65 only).
4. Change the value of Paranoia level associated with TCP windows to 2 or 3.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

CVE-2009-4609
Alert Name: Header Length
Description: TCP Window Error

CVE-2009-1926
Alert Name: Header Length
Description: TCP Window Error