Patent ID: 7752670
Filing Date: 2010-07-06
Classification: H04L

Abstract:
1. A method of detecting an attack of a network connection, comprising: receiving, by a network device over a network, a first message containing a sequence number that is within a valid sequence number range, the first message intended to cause reset of the network connection; dropping the first message even though the sequence number is within the valid sequence number range; in response to detecting that the sequence number in the first message is within the valid sequence number range, incrementing a first counter to track a number of occurrences of receiving the first message; receiving a data message containing a sequence number within the valid sequence number range and an acknowledge number outside a predefined acknowledge number range; dropping the data message in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range; and incrementing a second counter in response to receiving the data message containing the sequence number within the valid sequence number range and the acknowledge number outside the predefined acknowledge number range.