Date: Sat, 21 Sep 1996 16:22:46 +0930 (CST) From: newton@communica.com.au (Mark Newton) To: imp@village.org (Warner Losh) Cc: spfarrel@midway.uchicago.edu, newton@communica.com.au, security@FreeBSD.ORG Subject: Re: comments on the SYN attack Message-ID: <9609210652.AA03742@communica.com.au> In-Reply-To: <199609201625.KAA29669@rover.village.org> from "Warner Losh" at Sep 20, 96 10:25:42 am
next in thread | previous in thread | raw e-mail | index | archive | help
Warner Losh wrote: > : but what about randomly? first: i think randomly killing packets > : is a fallacy since the longer the packet remains on the queue, the > : more likely it will get killed (if 1% of packets are killed every > : second, then the packet which hangs out on the queue 100secs will > : probably get killed, whereas the one that hangs out 10secs will > : probably not.) -- so if there is an effective difference, it's > : odd and probably not very important. > > If you have a queue of 100, say, and 1 gets killed a second, then the > chances of survival for 100 seconds is about 36%. The chances of > survival for 10s is 91%. Given that you'll likely have more than one > valid SYN in even a 10s window, at least one of them should generally > survive. Initial SYNs are retransmitted, so dropping one of them > isn't bad as long as you don't drop them all. This is so bogus, Warner. You keep putting forward lots of good reasons which make the random approach better, but you neglect the fact that those exact, same factors make the deterministic approach better too. At the end of the day, both approaches collapse to exactly the same thing: They both have the OS saying, "Hmm - A SYN has just arrived and I don't have space for it, so I'll nuke an existing SYN to make room." The difference between the two is that the random method makes no effort to bias itself in favour of newly arrived packets which haven't had a chance to be SYN-ACK'ed yet. The two approaches are so similar that if you were to implement the random approach, I could transform it into the deterministic approach by merely *changing your random number generator routine*. Algorithmically speaking, we're talking about *EXACTLY* the same thing; you're just leaving out the bias whiich favours the algorithm towards new arrivals. > FIFO. In a FIFO killing model after 100s you are dead no matter > what, so it is a hard limit. This is a good thing, Warner: With your model, there is a 36% chance that a bad SYN will still be in the queue after 100s, according to your figures. :-) - mark --- Mark Newton Email: newton@communica.com.au Systems Engineer Phone: +61-8-8373-2523 Communica Systems WWW: http://www.communica.com.au
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?9609210652.AA03742>