Date: Fri, 14 May 1999 16:14:48 -0600 From: Brett Glass <brett@lariat.org> To: Harold Gutch <logix@foobar.franken.de>, Matthew Dillon <dillon@apollo.backplane.com> Cc: Jared Mauch <jared@puck.Nether.net>, Thamer Al-Herbish <shadows@whitefang.com>, security@FreeBSD.ORG Subject: Re: Forwarded from BUGTRAQ: SYN floods against FreeBSD Message-ID: <4.2.0.37.19990514161228.046541f0@localhost> In-Reply-To: <19990515001018.A22645@foobar.franken.de> References: <4.2.0.37.19990514154319.04610b80@localhost> <199905140438.VAA97604@apollo.backplane.com> <Pine.BSF.4.05.9905131824250.267-100000@rage.whitefang.com> <4.2.0.37.19990513161529.00c1e3f0@localhost> <Pine.BSF.4.05.9905131824250.267-100000@rage.whitefang.com> <4.2.0.37.19990513202450.0444fca0@localhost> <199905140438.VAA97604@apollo.backplane.com> <19990514072546.A20779@foobar.franken.de> <4.2.0.37.19990514133829.0461e220@localhost> <19990514225001.A22317@foobar.franken.de> <4.2.0.37.19990514154319.04610b80@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
At 12:10 AM 5/15/99 +0200, Harold Gutch wrote: >Why should we do anything at all ? Our current tactic (simply >dropping sockets in SYN_RCVD state) if a certain backlog fills up >and another SYN comes in seems to work quite well. You'll get in >trouble though if the flooder manages to flush through the >complete backlog in a timeframe shorter than the 2nd and the 3rd >packet of the handshake take for the way back to the client and >back to the server again. You can still mount an effective DoS with a SYN flood by killing a LARGE percentage of the new connections to the box. > It may also depend on the complexity of your routing tables. > > >1 loopback-route, 2 host routes, 2 network routes and a >default-route. Not much, but I could add a number of bogus routes >and try to crash the box then by SYN-flooding it. > >How many routes should I add ? I'm not sure. It also may depend on whether the table is in flux. See the original BUGTRAQ message which points out the bug. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.2.0.37.19990514161228.046541f0>