Hello,
Luca Pesce a écrit :
It doesn't seem like a very useful feature,
considering all the stacks supporting syn cookies.
Did you mean that syn cookies would drop that SYN with data anyway?
When the receiver has SYN cookies enabled, it replies to a SYN with a
SYN-ACK as usual, but does not keep any state for it. Instead the state
is stored in the ISN (used as a "cookie") of the SYN-ACK and will come
back in the final ACK of the 3-way handshake. Not keeping state means
that any data contained in the first SYN segment are discarded.
Or that MSS mangling itself would harm syn cookies tecniques?
I don't see why.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
