Patent ID: 8387143

Claim:
A method for probing a client side connection to determine if a client is using a malicious window size related attack, the method comprising: (a) receiving, by a device deployed as an intermediary between a client and a server, an acknowledgement packet as part of a handshake protocol for a request by the client to establish a transport layer connection with the server, the acknowledgement packet identifying a window size less than a predetermined value; (b) establishing, by the device, a first transport layer connection with the client without linking the first transport layer connection to a second transport layer connection to the server; (c) initiating, by the device, a predetermined number of window probes to the client over a predetermined time period; (d) dropping, by the device, a packet sent from the client responsive to a window probe in response to the packet identifying the window size is still less than the predetermined value; and (e) determining, by the device, upon a final window probe of the predetermined number of window probes that the client has not increased the window size beyond the predetermined value and disestablishing the first transport layer connection responsive to this determination.