Subject: Re: Questions on TCP backlog
To: B. James Phillippe <bryanxms@ecst.csuchico.edu>
From: der Mouse <mouse@Rodents.Montreal.QC.CA>
List: tech-net
Date: 10/20/2001 06:08:04
> 2.) IPv4 TCP ~ general connection request handling
> In any case, I'm trying to understand the mechanism used to
> queue new connection requests. Specifically, I am interested
> to know the design WRT SYN flood type attacks against local
> sockets. Is state tracked for SYN's, or is there some kind of
> mechanism similar to SYN cookies which obviates state tracking
> until the last stage of the 3WHS?
As I understand it, NetBSD tracks state for SYNs; someone put a good
deal of effort into it and managed to get the per-nascent-connection
overhead down to some insanely low figure - what I remember is 4 bytes
each.
No stateless mechanism (like SYN cookies) can possibly conform to the
TCP spec, because SYN+ACKs will never be retransmitted (which, it's
fairly easy to see, can lead to connections wedging, so this is a
practical as well as strict-conformance problem.)
/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B