Re: [PATCH RFC] netfilter: iptables target SYNPROXY

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

On Tue, 25 May 2010, Changli Gao wrote:

> On Tue, May 25, 2010 at 8:17 PM, Jozsef Kadlecsik
> <kadlec@xxxxxxxxxxxxxxxxx> wrote:
>
> > On Tue, 25 May 2010, Changli Gao wrote:
> >
> >> iptables target SYNPROXY.
> >>
> >> This patch implements an iptables target SYNPROXY, which works in the raw table
> >> of the PREROUTING chain, before conntracking system. Syncookies is used, so no
> >> new state is introduced into the conntracking system. In fact, until the first
> >> connection is established, conntracking system doesn't see any packets. So when
> >> there is a SYN-flood attack, conntracking system won't be busy on finding and
> >> deleting the un-assured ct.
> >
> > My main problem with your target is that by using it, important and useful
> > TCP options are lost: timestamp and SACK. That pushes back TCP by almost
> > twenty years.
> 
> Yea. Only MSS option is  supported. But it is better than being DoSed.
> And you can set a threshold for SYNPROXY with limit match, then there
> isn't any difference if there isn't any SYN-flood attack.

If I (have to) limit SYNPROXY, why shouldn't I better limit the SYN 
packets directly instead?

Best regards,
Jozsef
-
E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux