lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 11 Aug 2011 08:33:07 +0200 From: Eric Dumazet <eric.dumazet@...il.com> To: David Miller <davem@...emloft.net> Cc: therbert@...gle.com, netdev@...r.kernel.org Subject: Re: [RFC PATCH] tcp: Replace possible syn attack msg by counters Le mercredi 10 août 2011 à 23:13 -0700, David Miller a écrit : > From: Tom Herbert <therbert@...gle.com> > Date: Wed, 10 Aug 2011 22:38:02 -0700 (PDT) > > > Rather than printing the message to the log, use a mib counter to keep > > track of the count of occurences of syn cookies being used or syn > > being dropped when request queue is full. > > > > Rationale is these messages can fill up /var/log/messages on server > > which is simply under heavy load... I'm not sure how much more useful > > they would be in identifying a server DOS attack (compared to > > counters). > > > > Signed-off-by: Tom Herbert <therbert@...gle.com> > > Print the message once, and also do the counters. > > Say something like "Possible SYN flooding, see SNMP counters." or > similar. > > Because if people are grepping for that message in their logs, they > will now have a false sense of confidence seeing it not being there > any more. An alternative would be to guard the message by net_msg_warn (/proc/sys/net/core/warnings) LIMIT_NETDEBUG(KERN_INFO "TCP: Possible SYN flooding on port %d. %s.\n" ...) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists