Messages in this thread | | | Subject | Re: Size of Tasks during ddos | From | Andi Kleen <> | Date | Fri, 12 Sep 2003 01:08:49 +0200 |
| |
Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
> Syn cookies accept the SYN frame and encode sufficient information into > the reply that they can avoid storing any data until the next packet > arrives from the other end completing the connection. > > That means squashing all the information we track (mss, window, etc) > into very few bits. A modern TCP will offer large windows, selective ack > and other features which we can't fit into a syn cookie so with this off > a burst of traffic will cause pauses while the socket queue clears and > negotiate fully featured TCP, with syncookies enabled many of the > connections on the burst will not have the extra features so many not > perform as well.
Another side effect of syncookies is that flow control for new connections breaks: when you have a client that is connecting to a overloaded server it will only notice this after a long timeout. With syncookies off you get actually useful errnos back on connect().
(overloaded here doesn't necessarily mean DoS, just e.g. a single threaded service that is taking a long time to do some job and expresses this with a small argument to listen())
-Andi - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |