netdev - Re: SYN attack, with FIN flag set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 03 Dec 2011 20:40:36 +0200
From:	Denys Fedoryshchenko <denys@...p.net.lb>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	David Miller <davem@...emloft.net>,
	Michael Tokarev <mjt@....msk.ru>, <netdev@...r.kernel.org>
Subject: Re: SYN attack, with FIN flag set

 On Sat, 03 Dec 2011 11:02:02 +0100, Eric Dumazet wrote:
> Le samedi 03 décembre 2011 à 10:41 +0100, Eric Dumazet a écrit :
>> [PATCH] tcp: drop SYN+FIN messages
>>
>> Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his
>> linux machines to their limits.
>>
>> Dont call conn_request() if the TCP flags includes SYN flag
>>
>
> Oh well this should be :
>
> Dont call conn_request() if the TCP flags includes FIN flag

 Thats what i meant, maybe this will not slow down things (there is 
 other conditions already available, such as rst, just one more), but 
 will be somehow helpful for network administrators, since such attack 
 are bypassing --syn iptables flag. I hope it doesn't break anything.


 ---
 System administrator
 Denys Fedoryshchenko
 Virtual ISP S.A.L.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html