In message <10660.963669093@coconut.itojun.org>, itojun@iijlab.net writes:
>
>>| 1.113:
>>| be more cautious about tcp option length field.  drop bogus ones earlier.
>>| not sure if there is a real threat or not, but it seems that there's
>>| possibility for overrun/underrun (like non-NOP option with optlen > cnt).
>>it seems to me that this whole section of tcp_dooptions() should increment
>>a counter (e.g. "with bad options"). Agreement?
>
>	do you mean adding a new option?

I mean a new counter, viewable from netstat -s.

--jhawk