Messages in this thread |  | | Date | Fri, 8 Sep 2000 02:18:22 +0300 (EEST) | From | George Athanassopoulos <> | Subject | Re: linux kernel TCP, network connections and iptables |
| |
On Fri, 8 Sep 2000, Andi Kleen wrote:
:I forgot to add: Alexey is of course right in that it doesn't help you :at all. You cannot defend against packet floods, and with an active TCP :you can be always tricked into bouncing packets without load limit :(e.g. just by sending out of order packets for an established connection :or in a zillion other ways) : : :-Andi :
"At all" is not what I would say. Of course noone is trying to defend just at the kernel level. But I believe every step to make the linux kernel less trickable to such exploitation of TCP implementation "weaknesses", and also trying to make linux kernel behave less like a TCP flood amplifier, is welcomed (without serious or harmful "violation" of the protocol). Untill some other way comes up, I will try out Alan's patch. I believe it will help a lot, in conjuction with ipfw and some kind of dynamic manipulation of it.
Thanks Alan Cox and everyone else.
-- George Athanassopoulos http://www.real.macedonia.gr http://www.egnatia.ee.auth.gr
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/
|  |