Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
TheChosenOne
New Contributor II

Get count of half open tcp sessions

Hi :)

Recently a syn flood hit us and we want to protect us in the best way possible for the next time.

I found out that FortiADC can deal with it by using syn cookies. As we only have FortiGates... Can a Fortigate do something like this?
The only protection I found is the DoS protection policy's. But it seems to be less smart with a fixed threshold of pps.
If I set a threshold and we have a legitimate spike in our requests, connections from our customers would slow down or time out.

Any hints how to configure this the smartest way?
Can I somehow get the count of half opened connections from the fortigate?

Thank you!

7 REPLIES 7
nnair
Staff
Staff
TheChosenOne
New Contributor II

Hello nnair,

 

Thanks for your answer. How could the provided Link help me to answer my questions?

 

I'd like to know if the Fortigate can somehow provide a smarter protection than just limiting the pps count.

Also, how can I check the count of half open TCP sessions on a fortigate. Is this even possible?

 

Thank you!

 

Nchandan
Staff
Staff

Hi team,

 

if you set these thresholds too low, it can potentially impact legitimate traffic, causing it to slow down or even time out. This is especially true for features like connection limits, which can impact the number of concurrent connections allowed.

VinayHM
Staff
Staff

Hi @TheChosenOne 

 

You can get the session stats by the below command 

diagnose sys session stats


If you have found a solution, please like and accept it to make it easily accessible to others.

 

Regards!

Vinay HM
nageentaj
Staff
Staff

hi Team,

 

To  get the count of half opened connections from the fortigate.
Use the following command to display the count of half-opened connections:
get sys session list | grep "half-open"
This command retrieves the list of active sessions and then filters for entries with "half-open" in their description. It will show you the count of half-open connections.
Let us know if this has answered your query.

TheChosenOne
New Contributor II

Hi nageentaj,

have you tried what you wrote me?
"get sys session list" has no description column where a "half-open" could appear. grepping for it will never bring any results.

I found out a
"diagnose sys session list"
has the information im looking for, but the output is huge.

 

diagnose sys session clear to clear a fliter that is leftover, maybe
diagnose sys session filter proto 6 to add a filter for TCP
diagnose sys session filter proto-state 02 to add a filter for SYN_SENT session state
diagnose sys session list to liste the sessions with the filter criteria from above. The last line of the results is the total number of sessions.

Would be nice if one could get this via API.

VinayHM

Hi @TheChosenOne 

 

Please try this commands.

get sys session list | grep -f half-open

diag sys session stat | grep -f ESTABLISHED

 

If you have found a solution, please like and accept it to make it easily accessible for others.

 

Regards

Vinay HM
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors