A TCP Connection Establishment Filter: Symmetric Connection Detection

— Network measurement at 10+Gbps speeds imposes many restrictions on the resource consumption of the measurement application, making any filtering of input data highly desirable. Symmetric Connection Detection (SCD) is a method of filtering TCP sessions, passing only those sessions which become fully established. SCD can benefit network monitoring applications that are only interested fully established TCP connections by reducing processing requirements. Incomplete connection attempts, such as port scanning attempts, simply waste resources in many applications if they are not filtered. SCD filters out unsuccessful connection attempts using a combination of Bloom filters to track the state of connection establishment for every flow passing through a network device. Unsuccessful flows can be filtered out to a very high degree of accuracy, depending on the size of the Bloom filter and traffic rate, 99.5% is typical. Resource consumption, both memory and CPU is low. The core S...

• Type: Conference
• Year: 2007
• Where: ICC
• Authors: Brad Whitehead, Chung-Horng Lung, Peter Rabinovitch
• Keywords: Communications, Connection Attempts, ICC 2007, Resource Consumption, Unsuccessful Connection Attempts