- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Get count of half open tcp sessions
Hi :)
Recently a syn flood hit us and we want to protect us in the best way possible for the next time.
I found out that FortiADC can deal with it by using syn cookies. As we only have FortiGates... Can a Fortigate do something like this?
The only protection I found is the DoS protection policy's. But it seems to be less smart with a fixed threshold of pps.
If I set a threshold and we have a legitimate spike in our requests, connections from our customers would slow down or time out.
Any hints how to configure this the smartest way?
Can I somehow get the count of half opened connections from the fortigate?
Thank you!
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You may check the below link:
https://www.fortiguard.com/encyclopedia/ips/100663396
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello nnair,
Thanks for your answer. How could the provided Link help me to answer my questions?
I'd like to know if the Fortigate can somehow provide a smarter protection than just limiting the pps count.
Also, how can I check the count of half open TCP sessions on a fortigate. Is this even possible?
Thank you!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi team,
if you set these thresholds too low, it can potentially impact legitimate traffic, causing it to slow down or even time out. This is especially true for features like connection limits, which can impact the number of concurrent connections allowed.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can get the session stats by the below command
diagnose sys session stats
If you have found a solution, please like and accept it to make it easily accessible to others.
Regards!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi Team,
To get the count of half opened connections from the fortigate.
Use the following command to display the count of half-opened connections:
get sys session list | grep "half-open"
This command retrieves the list of active sessions and then filters for entries with "half-open" in their description. It will show you the count of half-open connections.
Let us know if this has answered your query.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi nageentaj,
have you tried what you wrote me?
"get sys session list" has no description column where a "half-open" could appear. grepping for it will never bring any results.
I found out a
"diagnose sys session list"
has the information im looking for, but the output is huge.
diagnose sys session clear to clear a fliter that is leftover, maybe
diagnose sys session filter proto 6 to add a filter for TCP
diagnose sys session filter proto-state 02 to add a filter for SYN_SENT session state
diagnose sys session list to liste the sessions with the filter criteria from above. The last line of the results is the total number of sessions.
Would be nice if one could get this via API.
Created on 10-11-2023 09:38 PM Edited on 10-11-2023 09:40 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please try this commands.
get sys session list | grep -f half-open
diag sys session stat | grep -f ESTABLISHED
If you have found a solution, please like and accept it to make it easily accessible for others.
Regards