4 ms·

This will make DoS attacks harder.

• Animats 11y ago
  Right. This doesn't mean connections open at that rate. It just means that systems are more resistant to SYN flooding attacks. Originally, upon receipt of a SYN, hosts began to open a connection and allocated the necessary state table and buffer resources. By sending bogus SYN requests, an attacker could tie up many buffer resources until the timer for connection opening timed out and released the resources. Defense against SYN flooding involves reducing the resources committed upon receipt of a SYN. Only on the next packet of the handshake are the connection resources committed. Most SYN flooding attacks use a phony source IP address, so the reply SYN with ACK goes to the phony IP address and the handshake never completes. There's now a TCP Fast Open proposal.[1] This allows sending data in the SYN packet. But that means committing resources on receipt of the SYN. That breaks this approach to DDOS mitigation, and has a different mechanism for dealing with phony SYN detection. Is the new code prepared for that? [1] https://tools.ietf.org/html/rfc7413 https://tools.ietf.org/html/rfc7413
  • lwf 11y ago
    Perhaps not, but the TCP Fast Open draft has some simple proposed mitigations: put a limit on the total number of PendingFastOpenRequests, and consider disabling TFO if your server is currently under a SYN attack. Both of these can be accomplished without a major loss of availability; you simply revert to the pre-TFO speeds/latencies.
• deleted 11y ago
  [deleted]