[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netbsd-tech-net
Subject:    Re: Questions on TCP backlog
From:       der Mouse <mouse () Rodents ! Montreal ! QC ! CA>
Date:       2001-10-20 10:08:04
[Download RAW message or body]

> 2.) IPv4 TCP ~ general connection request handling
> 	In any case, I'm trying to understand the mechanism used to
> 	queue new connection requests.  Specifically, I am interested
> 	to know the design WRT SYN flood type attacks against local
> 	sockets.  Is state tracked for SYN's, or is there some kind of
> 	mechanism similar to SYN cookies which obviates state tracking
> 	until the last stage of the 3WHS?

As I understand it, NetBSD tracks state for SYNs; someone put a good
deal of effort into it and managed to get the per-nascent-connection
overhead down to some insanely low figure - what I remember is 4 bytes
each.

No stateless mechanism (like SYN cookies) can possibly conform to the
TCP spec, because SYN+ACKs will never be retransmitted (which, it's
fairly easy to see, can lead to connections wedging, so this is a
practical as well as strict-conformance problem.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

[prev in list] [next in list] [prev in thread] [next in thread]