lkml.org 
[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: SYN trouble, hardware or software?
From
Date
Geert Uytterhoeven <Geert.Uytterhoeven@cs.kuleuven.ac.be> writes:

> On Wed, 22 Jul 1998, Chris Black wrote:
> > handshake (I think). We get messages on the master suck as:
> > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.12 on 192.168.1.1:20817. Sending cookies.
> > Jul 21 20:53:13 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.7 on 192.168.1.1:20860. Sending cookies.
> > Jul 21 20:56:15 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.11 on 192.168.1.1:20885. Sending cookies.
> > Jul 21 20:57:40 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.7 on 192.168.1.1:20897. Sending cookies.
> > Jul 21 21:01:30 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.7 on 192.168.1.1:20931. Sending cookies.
> > Jul 21 21:04:20 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.9 on 192.168.1.1:20954. Sending cookies.
> > Jul 22 14:11:13 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.4 on 192.168.1.1:24225. Sending cookies.
> > Jul 22 15:23:00 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.9 on 192.168.1.1:9393. Sending cookies.
> >
> > (er, that "suck" should be "such", but "suck" also applies)
> >
> > And on the slaves we get similar messages:
> > Jul 19 22:49:26 insect-01 kernel: Warning: possible SYN flood from
> > 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> > Jul 19 23:11:32 insect-01 kernel: Warning: possible SYN flood from
> > 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> > Jul 20 15:23:54 insect-01 kernel: Warning: possible SYN flood from
> > 192.168.1.1 on 192.168.1.2:9027. Sending cookies.
> >
> > Although the SYN messages on the master are understandably much more
> > frequent
> > than the ones on the slaves. I find it odd that even a socket to the
> > localhost
> > can generate incomplete SYN-initiated handshakes on the slaves. The
> > processes
> > that run on the slaves do use sockets to localhost to communicate to
> > processes
> > on the same host. This could be changed to be IPC shm or temporary
> > FIFOs, but
> > sockets to localhost are used for now.
> > No communication is done between the slaves, it is all master<->slave.
>
> ...
>
> > Software:
> > redhat linux 4.2, kernel 2.0.35 with "Jumbo-4" cyrix/cpuid patch.
>
> I've seen this on a 2.0.34 box (i486SX, 2x NE2000, 1x 3c509, routing,
> masquerading). People complained that FTP to the box no longer worked, and
> there were SYN flooding warnings in the logs.
>
> Then I tried to FTP from a box that was guaranteed not doing a SYN attack, and
> that box appeared in the kernel log as a possible attacker too. Rebooting the
> server fixed the problem. So I think this is a bug in the networking code.

The warning simply means that connection requests are comming in faster
than the server can process them.

The syn cookie code keeps no per host state of course, just a
per-socket-global counter and timestamp (it would make no sense because in
real syn flood attacks the source addresses are usually forged). So the
syn cookie code will just report one packet that happened to overflow
the backlog queue (and that the warning message load limiter let through)

[For the original poster:]
The problem is usually caused by too short listen() backlog lengths, combined
with slow servers that process connections slower than new ones are comming
in. Fix: search for listen() in the server source code and increase to
backlog argument to something higher (e.g. 100).

If you turn off syncookies then Linux will drop the syn, the client will
retransmit it and probably give better error messages if it fails; but
of course you would be vunerable to a synflood attack from the internet
then. Upping the listen queues is probably still required.



-Andi

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.063 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site