Patent ID: 7565694

Claim:
A computer-implemented method performed by a transmission control protocol (TCP) process in a network element, comprising the computer-implemented steps of: receiving, at the TCP process, from an application running on top of the TCP process that uses TCP connections, a request to ignore all TCP segments with an RST bit set, except for solicited RST segments; in response to the request, establishing a TCP filter that blocks all but solicited TCP RST segments; receiving a TCP segment with a SYN bit set and a sequence number value within an allowed window for a TCP connection matching the received TCP segment, wherein the received TCP segment is associated with a session of the application; re-configuring the TCP filter to allow TCP RST segments for the TCP connection associated with the received TCP segment; requesting the application to initiate an event that will solicit a legitimate sender of the received TCP segment to send a valid TCP RST segment in response; closing the TCP connection associated with the received TCP segment only when a TCP RST segment is received in response to the event; wherein the steps of receiving, reconfiguring, requesting, and closing are performed by one or more processors.