Understanding TCP SYN Checking

By default, JUNOS Software checks for SYN flags in the first packet of a session and rejects any TCP segments with non-SYN flags attempting to initiate a session. You can leave this packet flow as is or change it so that JUNOS Software does not enforce SYN flag checking before creating a session. Figure 84 illustrates packet flow sequences both when SYN flag checking is enabled and when it is disabled.

Figure 84: SYN Flag Checking

SYN Flag Checking

When JUNOS Software with SYN flag checking enabled receives a non-SYN TCP segment that does not belong to an existing session, it drops the packet and sends the source host to TCP RST—unless the code bit of the initial non-SYN TCP packet is also RST. In that case, JUNOS Software simply drops the packet.

Not checking for the SYN flag in the first packets offers the following advantages:

However, the previous advantages exact the following security sacrifices:

If you do not need SYN checking disabled, Juniper Networks strongly recommends that it be enabled (its default state for an initial installation of JUNOS Software). You can enable it with the set flow tcp-syn-check command. With SYN checking enabled, the device rejects TCP segments with non-SYN flags set unless they belong to an established session.

Related Documentation