lkml.org 
[lkml]   [1998]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[PATCH] ip_fragment.c and related, kernel 2.0.34 - Allows , teardrop/IP fragmentation logging.

[request for testing and comments]

teardrop/IP fragmentation logging patch
---------------------------------------

A patch for Linux 2.0.34.

Introduction
------------

This patch allows the option of logging possible attempted teardrop/
IP fragmentation attacks to the kernel messages file.

A similar message is generated in the current kernel, but only if NETDEBUG is
enabled. It also doesn't log the responsible host.

Installation
------------

This patch is for the kernel 2.0.34 source tree, but if you examine the patch
files you will see that the changes are very straightforward, so you could
easily implement them manually.

Go into /usr/src/linux and type:

patch -p0 <patch-file-name

... for each .patch file.

Usage
-----

Once the patch is completed you will need to recompile your kernel in the
normal way. Remember to do a "make config" to turn on the "IP: log suspected
teardrop attacks" option on.

Caveat
------

Your /var/log/messages (or whatever) file could become very full if a lot of
attacks are suddenly directed at your site. This in itself could be a DoS
attack! So please be wary when using this option.

However, usually Linux will compensate by using a "Message repeated x times"
message in the kernel logs.

Also remember that the attacker may be spoofing their IP address.

Comments
--------

Comments/suggestions are welcome. Please e-mail me using the address at
the top of this file.
[unhandled content-type:application/x-gunzip]
\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.027 / U:1.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site