hi there sems to be a bug in tcp connection tracking: if a connection does NOT close with a RST, then the state of the connection rests ESTABLISHED. So if you put a rule up like this on a attacker machine: iptables -A OUTPUT --dst <victim> -p tcp --tcp-flags ALL, RST -j DROP and then connection flood the victim, the connection track table will overflow and connection tracking will fail. This can be used as DOS against server who uses the state match. Sample Code is available: http://zhadum.ch/david/cdos.tgz -- ----------------------------------------------- +++ath0 --- Don't quote me --- +++ath0 Bofh excuse 9/424 The cause of the problem is: hardware stress fractures -----------------------------------------------
