Messages in this thread | | | Date | Mon, 13 Sep 2004 21:07:41 +0200 | From | Tonnerre <> | Subject | Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack |
| |
Salut,
On Mon, Sep 13, 2004 at 06:18:47AM +0200, Willy Tarreau wrote: > > The BGP state machine should instead, in normal operation, have > > only treated Hold time expired as the definitive sign of "peer is > > down" and allowed reconnects. > > It should not necessarily wait for the time-out, but at least wait for > a few reconnect errors.
Problem there: you can fake connection errors almost as easily as sending an RST packet, so the DoS might reappear, might it not?
Tonnerre [unhandled content-type:application/pgp-signature] | |