[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: RST not emitted on listen backlog full?
On May 11, 2010, at 12:26 24PM, Chuck Swiger wrote:
> On May 11, 2010, at 8:34 AM, Michael Richardson wrote:
>> I think the behaviour (TCP RST vs retransit) needs to be sysctl'able, or
> There's already SO_RCVTIMEO for setsockopt() which should be usable for the
> purpose on the client side...?
> The thing is, RFC-793 is pretty clear about when to RST and when not to.
> You're supposed to RST connection attempt requests when you know they are
> invalid (ie, to a port which is closed and so forth); but there is nothing
> which suggests it's OK to RST for a valid connection attempt to an open
> port-- see the "SEGMENT ARRIVES" section.
I mostly agree. The question is whether an RST is a better response if you're
enduring a SYN flood attack. I suspect that the answer is that it doesn't
matter much, since the bad guys will just keep sending, but it does bear a bit
--Steve Bellovin, http://www.cs.columbia.edu/~smb
Main Index |
Thread Index |