[lkml]   [2000]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: No more DoS
       Date: 	Fri, 22 Dec 2000 13:24:44 +1100 (CST)
    From: Mike OConnor <>

    I would like to point who ever is in charge of the TCP stack for
    the linux kernel at a site which claims to have a method of
    eliminate denial of service (DoS) attacks

    With my limited unstanding of TCP and DoS attacks this would seem
    to be the answer, instead of a work around.

    These people claim that no connection state needs to be saved for the
    beginning of the negotiation, and I claim this is unworkable because
    it ignores TCP timestamps entirely.

    Furthermore, it also cannot work because it makes retransmissions
    of the SYN/ACK very non-workable. I suppose his TCP stack just hacks
    around this by just waiting for the original client SYN to get
    retransmitted or something like this. I question whether that can
    even work reliably.

    I think not holding onto any state for an incoming SYN is nothing but
    a dream in any serious modern TCP implementation. It can be reduced,
    but not eliminated. The former is what most modern stacks have done
    to fight these problems.

    David S. Miller
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 12:52    [W:0.020 / U:63.320 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site