Patent ID: 11909762
Assignee: MELLANOX TECHNOLOGIES, LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system for efficiently thwarting syn flood DDoS attacks on a target server including a CPU, the system comprising:
a. network controller hardware having a steering capability; and
b. a software application to create and to configure initial steering object's which define a steering configuration of the network controller and monitor at least one opened connection to the server, including updating the steering configuration responsive to establishment of at least one connection to the server,
wherein the network controller hardware's steering capability is used to provide a SYN cookie value used for said thwarting, and to send at least one packet, modified, to the packet's source, without wasting target server CPU cycles on crypto hash calculation per SYN and ACK packets in real time, and without devoting per-packet target server CPU effort thereto in real time, and wherein the software application's creation and configuration of said initial steering object/s includes the following operations:
for TCP SYN/ACK packets, creating steering objects to look up a value over packet headers;
for at least one packet having a header, creating steering objects to reverse the packet's header and to send the packet back to the packet's source;
waiting for, and tracking, all incoming new connections;
waiting for, and tracking, all stalled or closed connections;
at least once, refreshing a created steering object to ensure randomness;
configuring at least one steering object/s for allowed established connections.