Patent ID: 8069352
Filing Date: 2011-11-29
Classification: H04L

Abstract:
1. A method performed in an intrusion detection/prevention system for determining whether a transmission control protocol (TCP) segment in a TCP connection in a communication network is acceptable, the TCP connection including a plurality of TCP segments beginning with a three way handshake, wherein a TCP segment includes a field for a timestamp, comprising: (A) determining which timestamp policy of plural different timestamp policies corresponds to an operating system of a target receiving the segments in a TCP connection, the different time stamp policies respectively corresponding to different operating systems; (B) identifying a baseline timestamp based on a three way handshake in the TCP connection; (C) monitoring, in a processor disposed between an origination and a destination of the TCP connection, segments in the TCP connection; and (D) filtering the segments in the TCP connection as indicated in the timestamp policy corresponding to the operating system of the target, the timestamp policy indicating whether the processor is to filter out or forward the segments to the target based on the operating system of the target by comparing the timestamp of the segments to the baseline timestamp, the segments in the TCP connection further being filtered out and forwarded to the target differently by the different time stamp policies based on the kind of operating system, the segments in the TCP connection further being filtered out and forwarded differently to the target by the different time stamp policies for the different operating systems according to zero timestamp values on the three-way handshake; and the segments in the TCP connection further being filtered out and forwarded differently to the target by the different time stamp policies for the different operating systems according to whether the segments have no TCP timestamp option and associated values even when both hosts have negotiated the use of timestamps, wherein, if the timestamp in the three way handshake is zero, the timestamp in the first TCP segment expected after the handshake becomes the baseline timestamp if properly received.