Re: DoS attack against TCP services

[mlelstv%serpens.de@localhost (Michael van Elst)]

bqt%update.uu.se@localhost (Johnny Billquist) writes:

>Timeout should not depend on distance, and should actually be (at least) 
>2*MSS, which would be something in the several minutes range.

It's 2*msl but msl can be a bit variable

net.inet.tcp.mslt.enable = 1
net.inet.tcp.mslt.loopback = 2
net.inet.tcp.mslt.local = 10
net.inet.tcp.mslt.remote = 60

If I understand this correctly, these msl values are in units of 500ms,
so 2*msl is the same value in seconds.

What is considered a local connection is a bit of magic and if you set
net.inet.tcp.mslt.enable=0 then everything is treated as a remote
connection.

-- 
-- 
                                Michael van Elst
Internet: mlelstv%serpens.de@localhost
                                "A potential Snark may lurk in every tree."