Messages in this thread | | | Subject | Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack | From | Florian Weimer <> | Date | Tue, 21 Sep 2004 00:02:46 +0200 |
| |
* Paul Jakma:
>> TCP-MD5 has no effect on ICMP based attacks., > > Hmm, good point. Which attacks, and what could be done about them? > (other than IPsec protect all traffic between peers).
You just filter ICMP packets, in the way RST packets are already filtered (i.e. rate limit).
The only TCP desynchronization attack that has a chance of working practice is the SYN-based one. The rate limit for RST processing on Cisco routers is far too low.
(Mixed Cisco/Quagga environments are a different matter, but rather unusual and easily DoSed anyway, most of the time.) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |