[lkml]   [2002]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectTCP: Treason uncloaked DoS ??
[posted here because the message itself apparantly only appears with debug 
stuff on.]

Please forgive my igonorance but our cluster of load balanced web servers
suddenly produced a run of:

TCP: Treason uncloaked! Peer XXX.XXX.XXX.XXX:4968/6666 shrinks window
2154146057:2154152518. Repaired.

lines in our error logs. I have tracked this down to timer.c and I can see
sort of what's going on [ please correct me if I'm wrong but I think a
client is saying 'send me something - ah but not at the moment because I'm
not ready to receive - but don't close the connection']. Question is are
multiple instances of this from multiple IPs a DoS possiblility. I assume
that the connections are kept open if the client connecting doesn't actually
go away so surely lots of these ocurring at once would overload a server. I
have googled this and an occasional instance seems normal and could be down
to a broken client, but lots from different IP addr's at once??

I'm a bit concerned that maybe someone is warming up for a hit or something.



To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:25    [W:0.027 / U:0.152 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site