Supporting options in a communication session using a TCP cookie

• US 20070185998A1
• Filed: 02/06/2006
• Published: 08/09/2007
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Goyal, Rajan, Touitou, Dan, Zayats, Michael
• Granted Patent: US 7,610,622 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A defender operable to support options in a communication session intercepts a connection request packet sent from a client to a server. The defender identifies a client option combination associated with the client from the connection request packet. The defender establishes a client option index corresponding to the client option combination, and encodes the client option index into a cookie of an acknowledgment packet. The defender then sends the acknowledgment packet to the client.

Claims

1. A method for supporting options in a communication session, comprising:

intercepting a connection request packet sent from a client to a server, the connection request packet intercepted by a defender;

identifying a client option combination from the connection request packet, the client option combination associated with the client;

establishing a client option index corresponding to the client option combination;

encoding the client option index into a cookie of an acknowledgment packet; and

sending the acknowledgment packet to the client.

2. The method of claim 1, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

3. The method of claim 1, further comprising:

establishing a server option combination corresponding to the client option combination, the server option combination associated with the server; and

sending the established server option combination as a part of the acknowledgment packet.

4. The method of claim 1, further comprising determining a corresponding option combination by:

sniffing a plurality of packets;

establishing the client option combination in response to sniffing the plurality of packets; and

establishing a server option combination corresponding to the client option combination in response to sniffing the plurality of packets.

5. The method of claim 1, further comprising generating a table comprising one or more corresponding option combinations by:

sniffing a plurality of packets;

establishing a plurality of corresponding option combinations in response to sniffing the plurality of packets, a corresponding option combination comprising an established client option combination and a corresponding established server option combination; and

selecting a subset from the plurality of corresponding option combinations.

6. The method of claim 1, further comprising discovering a corresponding option combination by:

allowing an allowable packet from the client to the server;

establishing the client option combination from the allowable packet;

allowing an allowable response packet from the server to the client; and

establishing a server option combination corresponding to the client option combination from the allowable response packet.

7. A defender operable to support options in a communication session, comprising:

an interface operable to;

intercept a connection request packet sent from a client to a server; and

a processor coupled to the interface and operable to;

identify a client option combination from the connection request packet, the client option combination associated with the client;

establish a client option index corresponding to the client option combination;

encode the client option index into a cookie of an acknowledgment packet; and

the interface further operable to;

send the acknowledgment packet to the client.

8. The defender of claim 7, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

9. The defender of claim 7, the processor further operable to:

establish a server option combination corresponding to the client option combination, the server option combination associated with the server; and

send the established server option combination as a part of the acknowledgment packet.

10. The defender of claim 7, the processor further operable to determine a corresponding option combination by:

sniffing a plurality of packets;

establishing the client option combination in response to sniffing the plurality of packets; and

establishing a server option combination corresponding to the client option combination in response to sniffing the plurality of packets.

11. The defender of claim 7, the processor further operable to generate a table comprising one or more corresponding option combinations by:

sniffing a plurality of packets;

establishing a plurality of corresponding option combinations in response to sniffing the plurality of packets, a corresponding option combination comprising an established client option combination and a corresponding established server option combination; and

selecting a subset from the plurality of corresponding option combinations.

12. The defender of claim 7, the processor further operable to discover a corresponding option combination by:

allowing an allowable packet from the client to the server;

establishing the client option combination from the allowable packet;

allowing an allowable response packet from the server to the client; and

establishing a server option combination corresponding to the client option combination from the allowable response packet.

13. A defender operable to support options in a communication session, comprising:

means for receiving a connection request packet from a client, the connection request packet directed to a server;

means for identifying a client option combination from the connection request packet, the client option combination associated with the client;

means for establishing a client option index corresponding to the client option combination;

means for encoding the client option index into a cookie of an acknowledgment packet; and

means for sending the acknowledgment packet to the client.

14. A method for supporting options in a communication session, comprising:

recording a client option combination in a connection request packet, the client option combination associated with a client, the client option combination recorded in the connection request packet by the client;

sending the connection request packet to a server, the server protected by a defender operable to intercept the connection request packet; and

receiving an acknowledgment packet from the defender, a client option index encoded into a cookie of the acknowledgment packet, the client option index corresponding to the client option combination.

15. The method of claim 14, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

16. The method of claim 14, further comprising:

inserting the cookie into a next acknowledgement packet; and

sending the next acknowledgement packet to the server, the defender operable to intercept the next acknowledgement packet.

17. A client operable to support options in a communication session, comprising:

a processor operable to;

record a client option combination in a connection request packet, the client option combination associated with the client;

an interface coupled to the processor and operable to;

send the connection request packet to a server, the server protected by a defender operable to intercept the connection request packet; and

receive an acknowledgment packet from the defender, a client option index encoded into a cookie of the acknowledgment packet, the client option index corresponding to the client option combination.

18. The client of claim 17, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

19. The client of claim 17, the processor further operable to:

insert the cookie into a next acknowledgement packet; and

send the next acknowledgement packet to the server, the defender operable to intercept the next acknowledgement packet.

20. A client operable to support options in a communication session, comprising:

means for recording a client option combination in a connection request packet, the client option combination associated with a client, the client option combination recorded in the connection request packet by the client;

means for sending the connection request packet to a server, the server protected by a defender operable to intercept the connection request packet; and

means for receiving an acknowledgment packet from the defender, a client option index encoded into a cookie of the acknowledgment packet, the client option index corresponding to the client option combination.