From nobody Fri Sep 5 10:03:48 2025 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cJBlM2K67z67NXJ for ; Fri, 05 Sep 2025 10:04:15 +0000 (UTC) (envelope-from michael.tuexen@lurchi.franken.de) Received: from drew.franken.de (drew.ipv6.franken.de [IPv6:2001:638:a02:a001:20e:cff:fe4a:feaa]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Certum Domain Validation CA SHA2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cJBlM05ddz3Jd5 for ; Fri, 05 Sep 2025 10:04:15 +0000 (UTC) (envelope-from michael.tuexen@lurchi.franken.de) Authentication-Results: mx1.freebsd.org; none Received: from smtpclient.apple (unknown [IPv6:2a02:8109:1101:be00:48f3:592c:5b5c:cc73]) (Authenticated sender: lurchi) by drew.franken.de (Postfix) with ESMTPSA id 0F3B8721BE00E; Fri, 5 Sep 2025 12:03:49 +0200 (CEST) Content-Type: text/plain; charset=us-ascii List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81\)) Subject: Re: Successful syn flooding DoS From: Michael Tuexen In-Reply-To: Date: Fri, 5 Sep 2025 12:03:48 +0200 Cc: freebsd-net@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <742A470C-1309-491B-A9F1-98CA402B6176@lurchi.franken.de> References: To: Peter 'PMc' Much X-Mailer: Apple Mail (2.3826.700.81) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Spamd-Bar: ---- X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:680, ipnet:2001:638::/32, country:DE] X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Rspamd-Queue-Id: 4cJBlM05ddz3Jd5 > On 5. Sep 2025, at 00:26, Peter 'PMc' Much = wrote: >=20 > Folks, >=20 > today I fell victim to a syn flooding party; one of my machines > went offline and needed a full reset to recover. >=20 > Why: > If somebody sends me a SYN (might be spoofed), I reply with SYN-ACK. > If there is a portforwarder in the path, then libalias will > consider this state of affairs a fully established connection, and > preserve the record, for... a day. >=20 > If somebody send me 100 SYN packets per second, then after a few > hour the libalias will have accumulated millions of these records. > They go into a tailq. And at that size, the network receiving > thread searching through that will run at 100% CPU. >=20 > That receiving thread is a network interrupt, prio 8, so if the > machine is a single vcore KVM, it won't do much else anymore. >=20 > As a quick measure I have now tried to change libalias to require a > bit more data before making the timeout that long. But in the > meantime the idiots have stopped their nonsense, so there is no > test. >=20 > Comments, anybody? That seems to be a problem of libalias. What middlebox setup are you using? Best regards Michael >=20 > cheerio, > PMc >=20