3 ms·
> TCP connections that don't match a handful of patterns would be suspicious (IMHO) and should probably just be dropped. I used to believe that. It is unfortun
by jvehent 12y ago
> TCP connections that don't match a handful of patterns would be suspicious (IMHO) and should probably just be dropped.
I used to believe that. It is unfortunately not true. TCP packets will come in all shapes and forms, and all must be treated equally, which is what makes TCP stacks so incredibly complex to implement.
The Linux TCP stack is quite safe and fast. Especially with tight integration with NICs hardware (checksum offloading and the like). I'm a bit unsure what a custom stack in userland can provide that the standard kernel stacks don't have.
- thirsteh 12y agoPerformance. This isn't for security, or it wouldn't be yet another critical piece of software written in C.
- tptacek 12y agoCan you be more specific about the different-but-equal forms TCP packets take? You can dive into the details; I've implemented TCP stacks too.
- robertgraham 12y agoThe Linux TCP stack is NOT fast. My DNS server can respond to DNS queries faster than the simplest of in-kernel echo servers (like ICMP ping or UDP port 7 echo). That's with the entire DNS overhead of parsing the DNS protocol, looking up the name in a very large database (like the .com zone), doing compression, and generating a response. The upshot is this: going through the Linux stack, a DNS server is limited to around 2 million queries/second. Using a custom user-mode stack, it can achieve 10 million queries per second.
- modusponens 12y agoDo you have any insight about how other stacks fare on that same workload? (*bsd, qnx, ms-windows, minix,osx...)