Hi, Pascal Hambourg<pascal.mail@xxxxxxxxxxxxxxx> wrote: > When the receiver has SYN cookies enabled, it replies to a SYN with a > SYN-ACK as usual, but does not keep any state for it. Instead the state is > stored in the ISN (used as a "cookie") of the SYN-ACK and will come back in > the final ACK of the 3-way handshake. Not keeping state means that any data > contained in the first SYN segment are discarded. thanks for your explanation! Ok, so if the receiver is using syn cookies, the data in the SYN would be discarded, and that is fine. But the current implementation of TCPMSS target is dropping the whole syn packet (if it is carrying any payload), so the receiver is not receiving the syn - in that case, the TCP connection could not be established. Again, I know that this scenario is very rare and awkward, I wan only thinking about relaxing that check in the TCPMSS target to let this SYN with data go through and establish the TCP connection, without caring too much about the payload. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
