Patent ID: 7251692

Claim:
A method for thwarting coordinated SYN denial of service (CSDoS) attacks against a server S disposed in a network of interconnected elements communicating using the TCP protocol, comprising the steps of controlling a network switch to divert a predetermined fraction of SYN packets destined for said server, to a web guard processor, establishing a first TCP connection between one or more clients originating said packets and said web guard processor, and a second TCP connection between said web guard processor and said server, so that packets can be transmitted between said one or more clients and said server, monitoring the number of timed-out connections between said web guard processor and said one or more clients, and if the number of timed-out connections between said web guard processor and said one or more clients exceeds a first predetermined threshold, controlling said switch to divert all SYN packets destined to said server to said web guard processor.