[lkml]   [2001]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: test SYN cookies (was Re: SYN cookies security bugfix?)
    Ed L Cashin <> writes:

    > What is a good way to test SYN cookies? I can induce a three-second
    > delay (on victim host V) before new TCP connections are accepted by
    > sending a burst of 2000 SYN packets (from attacker A), where V is
    > running a 2.2.14 or 2.2.17 kernel. During the three seconds ICMP echo
    > requests from A to V are being answered.
    > Turning on SYN cookies after /proc is mounted does not affect the
    > three-second pause, though, so I figure that either the pause is not
    > on account of a full half-open connection queue or SYN cookies are not
    > working.

    OK, I have found out that when I use three hosts to try to test SYN
    cookies there is no pause, so the pause was a red herring. However,
    tests still seem to indicate that the SYN cookies feature doesn't do

    Host A sends a SYN flood to host B, now sporting a new 2.2.20 kernel
    (with SYN cookie support, of course). Host C makes repeated TCP
    connections and ICMP echo requests to host B in order to monitor host

    However, even after setting tcp_max_syn_backlog to 1 on host B, I do
    not observe any difference in connection times (from B to C) during a
    SYN flood (from A to B) whether tcp_syncookies are on or off on host B
    (1 or 0). I am restarting the server on B each time I make an
    adjustment in /proc.

    Is there anyone who has any evidence that SYN cookies do anything in
    kernel 2.2.x? If so, how did you get that evidence, because I would
    like to reproduce it.

    --Ed Cashin PGP public key:

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:13    [W:0.025 / U:2.948 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site