Re: DoS attack against TCP services

[Johnny Billquist <bqt%update.uu.se@localhost>]

On 2015-01-19 10:24, Michael van Elst wrote:
> 6bone%6bone.informatik.uni-leipzig.de@localhost writes:
>
> > > > Unfortunately, all TCP connections are now in the TIME_WAIT state.
> > > >
> > > > bash-4.3 # netstat -a -n | grep TIME_WAIT | wc -l
> > > >       34611
> > > >
> > > > Is there a way to remove it without rebooting the server?
> > >
> > > tcpdrop(8)?
>
> > It works. But why doesn't drop the kernel it automatically?
>
>
> TCP connections in TIME_WAIT will expire after some time, usually between
> 10 and 60 seconds after a connection is closed. The timeout depends on
> the distance of the remote machine.

Timeout should not depend on distance, and should actually be (at least) 
2*MSS, which would be something in the several minutes range.
But apart from that - yes - the kernel should expire and remove sockets 
in TIME_WAIT after a while.

But I might be wrong, and the standards have changed. I'm mostly going 
on some rather old RFCs here...

	Johnny

--
Johnny Billquist                  || "I'm on a bus
                                  ||  on a psychedelic trip
email: bqt%softjar.se@localhost             ||  Reading murder books
pdp is alive!                     ||  tryin' to stay hip" - B. Idol