基于Linux下防止IP欺骗的SYN攻击防火墙的设计与实现  

Preventing IP Spoofing Attack SYN Firewall Design and Implementation Based on Linux

作　　者：张小川[1] 付存君[1] 

机构地区：[1]重庆理工大学计算机科学与工程学院,重庆400054

出　　处：《科学技术与工程》2013年第1期244-247,共4页Science Technology and Engineering

基　　金：国家自然科学基金(60443004)资助

摘　　要：设计是以redhat5.0为实验平台构建一个防御IP欺骗SYN攻击的包过滤防火墙。是以RED算法为基础,结合TCP数据包重传机制,检验SYN数据包的IP地址真实性。对TCP请求数据包利用RED算法判断TCP请求的平均队列长度和包丢弃概率。平均队列长度超过系统负载最大值时,直接按照随机分配的丢弃概率判断是否丢弃数据包。平均队列长度在系统负载之内时,如果当前的丢弃概率大于给定的阈值,则查找哈希表是否有相同的数据节点,找到则接受该数据包,没找到则保存数据包信息到哈希表,同时丢弃该包。经过分析研究和实验的验证,该防火墙具有较好的吞吐量,同时正常数据包的通过率较高。The design is based on redhat5. 0 experiment platform, its aim is to build a packet filtering firewall to defend IP spoofing SYN attack. Based on RED algorithm, combination of TCP packet retransmission mechanism, SYN packet IP address authenticity is inspected. Using the RED algorithm to determine the average queue length of TCP and packet dropping probability, average queue size exceeds the maximum value that the system can bear, di- rectly according to the random assignment of the drop probability to judge whether discard packets. The average queue length in the system loading, if the current discard probability is greater than a given threshold, then check hash table have the same data node or not, found to accept the packet, not found preserved the information of data packet to a hash table, and discard the packet. After analysis and experimental verification this firewall has better throughput, while the normal data packet has higher rate.

关 键 词：防火墙 SYN攻击 RED算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]