Patent ID: 7373663
Filing Date: 2008-05-13
Classification: H04L

Abstract:
1. A method of detecting a denial of service attack on a connection in a digital communications system, the method comprising the steps of: providing a hash table, said hash table having a corresponding hash function and for storing a plurality of counters, each counter associated with an index of the hash table, each index calculated with use of said hash function; determining for a TCP SYN packet received, a first index of said hash table by adding a value dependent upon an initial sequence number of said TCP SYN packet to the hash function of a secret key and at least one header field of said TCP SYN packet; incrementing a first counter associated with said first index; selecting, based on a probability per packet received other than a SYN, FIN, or RST packet, a subsequent packet; determining for said subsequent packet selected, a second index of said hash table by adding a value dependent upon a sequence number of said subsequent packet to the hash function of said secret key and the at least one header field of said subsequent packet; and determining that there is a denial of service attack, if: are all zero.