Get count of half open tcp sessions

[TheChosenOne]

Hi :)

Recently a syn flood hit us and we want to protect us in the best way possible for the next time.

I found out that FortiADC can deal with it by using syn cookies. As we only have FortiGates... Can a Fortigate do something like this?
The only protection I found is the DoS protection policy's. But it seems to be less smart with a fixed threshold of pps.
If I set a threshold and we have a legitimate spike in our requests, connections from our customers would slow down or time out.

Any hints how to configure this the smartest way?
Can I somehow get the count of half opened connections from the fortigate?

Thank you!

[nnair]

You may check the below link:

https://www.fortiguard.com/encyclopedia/ips/100663396

[TheChosenOne]

Hello nnair,

Thanks for your answer. How could the provided Link help me to answer my questions?

I'd like to know if the Fortigate can somehow provide a smarter protection than just limiting the pps count.

Also, how can I check the count of half open TCP sessions on a fortigate. Is this even possible?

Thank you!

[Nchandan]

Hi team,

if you set these thresholds too low, it can potentially impact legitimate traffic, causing it to slow down or even time out. This is especially true for features like connection limits, which can impact the number of concurrent connections allowed.

[VinayHM]

Hi @TheChosenOne 

You can get the session stats by the below command 

diagnose sys session stats

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards!

[nageentaj]

hi Team,

To  get the count of half opened connections from the fortigate.
Use the following command to display the count of half-opened connections:
get sys session list | grep "half-open"
This command retrieves the list of active sessions and then filters for entries with "half-open" in their description. It will show you the count of half-open connections.
Let us know if this has answered your query.

[TheChosenOne]

Hi nageentaj,

have you tried what you wrote me?
"get sys session list" has no description column where a "half-open" could appear. grepping for it will never bring any results.

I found out a
"diagnose sys session list"
has the information im looking for, but the output is huge.

diagnose sys session clear to clear a fliter that is leftover, maybe
diagnose sys session filter proto 6 to add a filter for TCP
diagnose sys session filter proto-state 02 to add a filter for SYN_SENT session state
diagnose sys session list to liste the sessions with the filter criteria from above. The last line of the results is the total number of sessions.

Would be nice if one could get this via API.

[VinayHM]

Hi @TheChosenOne 

Please try this commands.

get sys session list | grep -f half-open

diag sys session stat | grep -f ESTABLISHED

If you have found a solution, please like and accept it to make it easily accessible for others.

Regards