lkml.org 
[lkml]   [2000]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: linux kernel TCP, network connections and iptables
On Fri, 8 Sep 2000, Andi Kleen wrote:

:I forgot to add: Alexey is of course right in that it doesn't help you
:at all. You cannot defend against packet floods, and with an active TCP
:you can be always tricked into bouncing packets without load limit
:(e.g. just by sending out of order packets for an established connection
:or in a zillion other ways)
:
:
:-Andi
:

"At all" is not what I would say. Of course noone is trying to defend
just at the kernel level. But I believe every step to make the linux
kernel less trickable to such exploitation of TCP implementation
"weaknesses", and also trying to make linux kernel behave less like
a TCP flood amplifier, is welcomed (without serious or harmful
"violation" of the protocol).
Untill some other way comes up, I will try out Alan's patch. I believe
it will help a lot, in conjuction with ipfw and some kind of dynamic
manipulation of it.

Thanks Alan Cox and everyone else.

--
George Athanassopoulos
http://www.real.macedonia.gr
http://www.egnatia.ee.auth.gr

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:38    [W:0.072 / U:4.548 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site