Subject: Re: DoS using crafted ICMP "frag needed" packets
To: None <tech-net@netbsd.org>
From: Jed Davis <jdev@panix.com>
List: tech-net
Date: 06/22/2005 02:56:57
In article <20050621180211.GA360@panix.com>,
Ed Ravin  <eravin@panix.com> wrote:
> 
> 3) Add a threshold or other rate-limiting to each TCP connection - after
> NN "fragmentation needed" messages, either ignore the messages or ignore
> the MTU size and use the internal table to drop down to the next MTU size.

The nice thing about this option is that, implemented reasonably, it
won't break any aspect of legitimate modern PMTUD, as far as I can see.


-- 
(let ((C call-with-current-continuation)) (apply (lambda (x y) (x y)) (map
((lambda (r) ((C C) (lambda (s) (r (lambda l (apply (s s) l))))))  (lambda
(f) (lambda (l) (if (null? l) C (lambda (k) (display (car l)) ((f (cdr l))
(C k)))))))    '((#\J #\d #\D #\v #\s) (#\e #\space #\a #\i #\newline)))))