Messages in this thread | | | From | Herbert Xu <> | Subject | Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack | Date | Tue, 21 Sep 2004 12:14:48 +1000 |
| |
Florian Weimer <fw@deneb.enyo.de> wrote: > >>> TCP-MD5 has no effect on ICMP based attacks., >> >> Hmm, good point. Which attacks, and what could be done about them? >> (other than IPsec protect all traffic between peers). > > You just filter ICMP packets, in the way RST packets are already > filtered (i.e. rate limit).
Rate-limiting has no effect on ICMP attacks unless your limit is such that you're effectively dropping them all. But then you get PMTU problems... -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |