[lkml]   [2000]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subjectlinux kernel TCP, network connections and iptables
    I am not sure if this is the right list to point out some linux TCP
    implementation "weakness" but I think that something should be done
    first at the kernel level and after with any other way (firewalling etc).
    The problem:
    I am using 2.0.38 and I am receiving lots of DoS attacks on one of my
    servers (used as ftp and irc server as well). A piece of tcpdump follows:
    02:52:44.448067 > . ack 1247023010 win 655
    35 (DF)
    02:52:44.448067 > R 1247023010:1247023010(
    0) win 0
    02:52:44.448067 > . ack 1247023010 win 655
    35 (DF)
    02:52:44.448067 > R 1247023010:1247023010(
    0) win 0
    02:52:44.448067 > . ack 1628640333 win 6553
    5 (DF)
    02:52:44.448067 > R 1628640333:1628640333(0
    ) win 0
    The DoS is caused by the machine itself since it floods out itself with RST
    packets, since the machine replies to MANY repeated incoming ACK packets hitting
    unused ports.

    The questions:
    - Could there be some kind of handling for such packets (meaning TCP packets
    reaching at an unused port with ACK bit set - with no previous SYN etc packet)
    to avoid such DoS attacks? Is the same happening to newer kernels? If yes,
    should we just eat it and shut up (because that's the way TCP works and it
    will not change)?
    - To do something about the above DoS, I am raw monitoring every incoming packet
    and, for every incoming packet I receive with ACK bit set, I bind to that
    port and if it is used, then I let it pass or else I block it (for some
    random minutes) with ipfw. I tried to read /proc/net/tcp to find out which
    ports are used but that came out to be bad because if I read /proc/net/tcp
    too fast and many times per second, the load average goes really high.
    So, is there any way, any documentation about any system call or any
    more direct, faster kernel-way to get what /proc/net/tcp gives at any time?
    If yes, could you please direct me there?

    I haven't used iptables yet but I think they can handle packets with various
    bits sets (including RST), unlike ipfw. But, is there any way with iptables
    to know if a port is "used" or "unused" at any time? And if yes, at what
    state (listening, at the middle of a 3-way TCP handshaking etc) also?

    Good day to all.

    George Athanassopoulos

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 12:38    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean