Hi, On Tue, 25 May 2010, Changli Gao wrote: > On Tue, May 25, 2010 at 8:17 PM, Jozsef Kadlecsik > <kadlec@xxxxxxxxxxxxxxxxx> wrote: > > > On Tue, 25 May 2010, Changli Gao wrote: > > > >> iptables target SYNPROXY. > >> > >> This patch implements an iptables target SYNPROXY, which works in the raw table > >> of the PREROUTING chain, before conntracking system. Syncookies is used, so no > >> new state is introduced into the conntracking system. In fact, until the first > >> connection is established, conntracking system doesn't see any packets. So when > >> there is a SYN-flood attack, conntracking system won't be busy on finding and > >> deleting the un-assured ct. > > > > My main problem with your target is that by using it, important and useful > > TCP options are lost: timestamp and SACK. That pushes back TCP by almost > > twenty years. > > Yea. Only MSS option is supported. But it is better than being DoSed. > And you can set a threshold for SYNPROXY with limit match, then there > isn't any difference if there isn't any SYN-flood attack. If I (have to) limit SYNPROXY, why shouldn't I better limit the SYN packets directly instead? Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
