Syncookies

From dankwiki
Jump to: navigation, search

DJB's page: http://cr.yp.to/syncookies.html

Issues with DJB's Writeup

  • "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."

Other Issues

  • Only eight distinct MSS values can be chosen, due to only three bits for MSS in the 32 bits of a SYNcookie

Other Mitigations for SYNfloods

  • SYNproxying by a powerful intermediary