lkml.org 
[lkml]   [1998]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: SYN/RST Cookies [Was: Re: SYN flood = VFS: No free inodes - contact Linus?]
From
Date
Mike Johnson <Mike.Johnson@GSC.GTE.Com> writes:

> [Okay, let's try this again. I meant this to go to linux-kernel,
> but I was a monkey and only sent it to David S. Miller who promptly
> responded with some great ideas (thanks again David!) but I wanted
> to get some other thoughts from other folks out there. Maybe someone
> had the same problem I did...]
>
> At 05:39 PM 3/12/98 -0800, you wrote:
>
> >Firstly, I advise to turn off RST cookies, only the SYN cookies are
> >reliable. In fact there are some known flaws in the RST cookies.
>
> Um, is there any documentation of this? I need to learn more about
> SYN and RST cookies and such. I know their purpose, I know they
> take two different approaches, and I know RST cookies use more memory.
> However, I run MUDs on my Linux box (RH 5.0 - 2.0.33) and when I ran
> SYN cookies, people were having problems with the game hanging up on
> them. This was reported to the mailing list for that type of MUD
> (it's actually MUX), and -only- people using Linux were having problems
> with that. The author of MUX decided to blame it on Linux and move
> on. After switching to RST cookies, I don't think I've had anyone
> get hung up on. Can anyone enlighten me on this?

Syncookies have some potential of hanging valid connection requests because of
sequence space reuse, but it is <1%. For RST cookies this probability
is a little bit lower, but they have other problems (including that they
don't work with many types of firewalls, and that there is a 'bad interaction'
with the win95 stack and that there are known flaws that allow synflooding).
2.0.34 will have RST cookies disabled.

Regarding the MUX problem: syncookies are only active at all when the machine
is under a synflood or is overloaded - that means receives more connection
requests than specified in the listen(2) backlog at the same time. You'll
always see degradation of service in this case. The probability I cited
above is _only_ for this case - syncookies are never send out in normal
service. They only apply to connection setups anyways, not to already
established TCP connections. I guess the author was too fast in blaming Linux.

If you want to read more details about the inner workings of syncookies
read koobera.math.uic.edu:/pub/docs/syncookies-archive The only documentation
(AFAIK) for the workings of RST cookies is the source code or Eric Schenk's
announcement on the netdev mailing list, which should be archived somewhere
on the internet.

-Andi



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.026 / U:0.300 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site