Messages in this thread | | | Date | Fri, 18 Sep 1998 15:57:09 +0100 (BST) | From | Tristan Greaves <> | Subject | [PATCH] ip_fragment.c and related, kernel 2.0.34 - Allows , teardrop/IP fragmentation logging. |
| |
[request for testing and comments]
teardrop/IP fragmentation logging patch ---------------------------------------
A patch for Linux 2.0.34.
Introduction ------------
This patch allows the option of logging possible attempted teardrop/ IP fragmentation attacks to the kernel messages file.
A similar message is generated in the current kernel, but only if NETDEBUG is enabled. It also doesn't log the responsible host.
Installation ------------
This patch is for the kernel 2.0.34 source tree, but if you examine the patch files you will see that the changes are very straightforward, so you could easily implement them manually.
Go into /usr/src/linux and type: patch -p0 <patch-file-name
... for each .patch file.
Usage -----
Once the patch is completed you will need to recompile your kernel in the normal way. Remember to do a "make config" to turn on the "IP: log suspected teardrop attacks" option on.
Caveat ------
Your /var/log/messages (or whatever) file could become very full if a lot of attacks are suddenly directed at your site. This in itself could be a DoS attack! So please be wary when using this option.
However, usually Linux will compensate by using a "Message repeated x times" message in the kernel logs.
Also remember that the attacker may be spoofing their IP address.
Comments --------
Comments/suggestions are welcome. Please e-mail me using the address at the top of this file. [unhandled content-type:application/x-gunzip]
| |