Date: Fri, 1 Dec 2000 11:13:40 -0800 From: Alan Batie <alan@batie.org> To: "David G. Andersen" <dga@pobox.com> Cc: Umesh Krishnaswamy <umesh@juniper.net>, freebsd-security@FreeBSD.ORG Subject: Re: Defeating SYN flood attacks Message-ID: <20001201111340.P45293@agora.rdrop.com> In-Reply-To: <200012011906.MAA25650@faith.cs.utah.edu>; from dga@pobox.com on Fri, Dec 01, 2000 at 12:06:45PM -0700 References: <3A27F625.4C87CC7C@juniper.net> <200012011906.MAA25650@faith.cs.utah.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 01, 2000 at 12:06:45PM -0700, David G. Andersen wrote: > FreeBSD has been synflood resistant for several years. To a first order, > you cannot effectively synflood a decently provisioned FreeBSD box and > deny service to it UNLESS your "synflood" is really just a bandwidth > consumption attack that eats up all of their bandwidth. > > There was a problem that cropped up about a year ago where a *really high > volume* syn flood could cause some kernel problems, but that's fixed in > all of the recent 4.x versions. Really high volume means 10Mbps+. I was just subject to such an attack last weekend; I'm running 4.1-RELEASE at the moment. The attack was SYNs from a large number of (probably spoofed, randomly generated) addresses to a sequence of ports. The reason I noticed it was because the port unreachable icmp messages exceeded the default icmp bandwidth limit and the console and syslog were filled with the resulting messages about that. The attack ran from Friday evening until Monday morning. I'm not sure if it's related, but it's suspicious, that the system under attack crashed (wedged) Sunday morning. FWIW -- Alan Batie ______ www.rdrop.com/users/alan Me alan@batie.org \ / www.qrd.org The Triangle PGPFP DE 3C 29 17 C0 49 7A \ / www.pgpi.com The Weird Numbers 27 40 A5 3C 37 4A DA 52 B9 \/ www.anti-spam.net NO SPAM! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001201111340.P45293>