Supporting options in a communication session using a TCP cookie

• US 7,610,622 B2
• Filed: 02/06/2006
• Issued: 10/27/2009
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Zayats, Michael, Goyal, Rajan, Touitou, Dan
• Primary Examiner(s): Eng; David Y
• Application Number:
  US11/348,977
• Publication Number:
  US 20070185998A1
• Time in Patent Office: 1,359 Days
• Field of Search: 726/22, 709/223, 709/229
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A defender operable to support options in a communication session intercepts a connection request packet sent from a client to a server. The defender identifies a client option combination associated with the client from the connection request packet. The defender establishes a client option index corresponding to the client option combination, and encodes the client option index into a cookie of an acknowledgment packet. The defender then sends the acknowledgment packet to the client.

Claims

1. A method for supporting options in a communication session, comprising:

intercepting a connection request packet sent from a client to a server, the connection request packet intercepted by a defender;

identifying a client option combination of the client from the connection request packet, the client option combination comprising a set of one or more Transmission Control Protocol (TCP) parameters for communication with the client;

establishing a client option index corresponding to the client option combination, the client option index configured to be encoded into a cookie to communicate the client option combination;

encoding the client option index into a cookie of an acknowledgment packet in order to provide the client option index to the client; and

sending the acknowledgment packet to provide to the client the client option index used to communicate the client option combination client in order to facilitate establishing a connection requested by the connection request packet.

2. The method of claim 1, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

3. The method of claim 1, further comprising:

establishing a server option combination corresponding to the client option combination, the server option combination associated with the server, the server option combination comprising a set of one or more parameters for communication with the server; and

sending the established server option combination as a part of the acknowledgment packet.

4. The method of claim 1, further comprising determining a corresponding option combination by:

sniffing a plurality of packets;

establishing the client option combination in response to sniffing the plurality of packets; and

establishing a server option combination corresponding to the client option combination in response to sniffing the plurality of packets, the server option combination comprising a set of one or more parameters for communication with the server.

5. The method of claim 1, further comprising generating a table comprising one or more corresponding option combinations by:

sniffing a plurality of packets;

establishing a plurality of corresponding option combinations in response to sniffing the plurality of packets, a corresponding option combination comprising an established client option combination and a corresponding established server option combination, the server option combination comprising a set of one or more parameters for communication with the server; and

selecting a subset from the plurality of corresponding option combinations.

6. The method of claim 1, further comprising discovering a corresponding option combination by:

allowing an allowable packet from the client to the server;

establishing the client option combination from the allowable packet;

allowing an allowable response packet from the server to the client; and

establishing a server option combination corresponding to the client option combination from the allowable response packet, the server option combination comprising a set of one or more parameters for communication with the server.

7. A defender operable to support options in a communication session, comprising:

an interface operable to;

intercept a connection request packet sent from a client to a server; and

a processor coupled to the interface and operable to;

identify a client option combination of the client from the connection request packet, the client option combination comprising a set of one or more Transmission Control Protocol (TCP) parameters for communication with the client;

establish a client option index corresponding to the client option combination, the client option index configured to be encoded into a cookie to communicate the client option combination;

encode the client option index into a cookie of an acknowledgment packet in order to provide the client option index to the client; and

the interface further operable to;

send the acknowledgment packet to provide to the client the client option index used to communicate the client option combination client in order to facilitate establishing a connection requested by the connection request packet.

8. The defender of claim 7, wherein:

the connection request packet comprises a SYN packet; and

the acknowledgment packet comprises a SYN acknowledgment packet.

9. The defender of claim 7, the processor further operable to:

establish a server option combination corresponding to the client option combination, the server option combination associated with the server, the server option combination comprising a set of one or more parameters for communication with the server; and

send the established server option combination as a part of the acknowledgment packet.

10. The defender of claim 7, the processor further operable to determine a corresponding option combination by:

sniffing a plurality of packets;

establishing the client option combination in response to sniffing the plurality of packets; and

establishing a server option combination corresponding to the client option combination in response to sniffing the plurality of packets, the server option combination comprising a set of one or more parameters for communication with the server.

11. The defender of claim 7, the processor further operable to generate a table comprising one or more corresponding option combinations by:

sniffing a plurality of packets;

establishing a plurality of corresponding option combinations in response to sniffing the plurality of packets, a corresponding option combination comprising an established client option combination and a corresponding established server option combination, the server option combination comprising a set of one or more parameters for communication with the server; and

selecting a subset from the plurality of corresponding option combinations.

12. The defender of claim 7, the processor further operable to discover a corresponding option combination by:

allowing an allowable packet from the client to the server;

establishing the client option combination from the allowable packet;

allowing an allowable response packet from the server to the client; and

establishing a server option combination corresponding to the client option combination from the allowable response packet, the server option combination comprising a set of one or more parameters for communication with the server.

13. A defender operable to support options in a communication session, comprising:

means for receiving a connection request packet from a client, the connection request packet directed to a server;

means for identifying a client option combination of the client from the connection request packet, the client option combination comprising a set of one or more Transmission Control Protocol (TCP) parameters for communication with the client;

means for establishing a client option index corresponding to the client option combination, the client option index configured to be encoded into a cookie to communicate the client option combination;

means for encoding the client option index into a cookie of an acknowledgment packet in order to provide the client option index to the client; and

means for sending the acknowledgment packet to provide to the client the client option index used to communicate the client option combination client in order to facilitate establishing a connection requested by the connection request packet.