4 ms·
> original initial the word 'initial [sequence number]' is a term of art, not an adjective that can be substituted. very commonly called ISN. odd that the art
by jiveturkey 7y ago
> original
initial
the word 'initial [sequence number]' is a term of art, not an adjective that can be substituted. very commonly called ISN. odd that the article never used the acronym.
> syn cookies are generally bad because they prevent to negotiate window scaling.
this is wrong thinking. they degrade performance under "attack", yes. the alternative is instant death. "attacks" need not be from the big bad internet either. my experience is that in the last 10 years most synflood activations are internal buggy or poorly throttled clients.
> enabling tcp timestamps in general case brings little benefit
disagree, but sibling comment addresses this.
- toast0 7y ago> my experience is that in the last 10 years most synflood activations are internal buggy or poorly throttled clients. From running a large messaging service I agree; most of the perceived attacks (synflood or otherwise) were actually coming from our own clients. But there was a periodic stream of strictly abusive traffic coming from who knows where; mostly UDP reflection, but a SYN flood every once in a while.