Syncookies - revision history

Dank at 02:25, 20 May 2011

2011-05-20T02:25:08Z

← Older revision		Revision as of 02:25, 20 May 2011
Line 12:		Line 12:
	==Other Mitigations for SYNfloods==		==Other Mitigations for SYNfloods==
	* SYNproxying by a powerful intermediary		* SYNproxying by a powerful intermediary
			[[CATEGORY: Networking]]
			[[CATEGORY: Offensive Computing]]

2009-06-11T01:54:06Z

Issues with DJB's Writeup

← Older revision		Revision as of 01:54, 11 June 2009
Line 4:		Line 4:
	* "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."		* "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."
	** This is only true for machines expected to suffer SYNflood attacks.		** This is only true for machines expected to suffer SYNflood attacks.
	** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines		** The [[TCP\|usefulness of TCP Large Window Extensions]] and [[TCP\|SACK]] means I disable SYNcookies on internal machines
	*** Linux 2.6.26 added support for encoding some options into timestamps (see [http://lwn.net/Articles/277146/ this LWN article]).		*** Linux 2.6.26 added support for encoding some options into timestamps (see [http://lwn.net/Articles/277146/ this LWN article]).

2009-06-11T01:53:24Z

← Older revision		Revision as of 01:53, 11 June 2009
Line 5:		Line 5:
	** This is only true for machines expected to suffer SYNflood attacks.		** This is only true for machines expected to suffer SYNflood attacks.
	** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines		** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines
	*** Linux 2.6.26 added support for encoding some options into timestamps		*** Linux 2.6.26 added support for encoding some options into timestamps (see [http://lwn.net/Articles/277146/ this LWN article]).

	==Other Issues==		==Other Issues==

2009-06-11T01:52:50Z

← Older revision		Revision as of 01:52, 11 June 2009
Line 5:		Line 5:
	** This is only true for machines expected to suffer SYNflood attacks.		** This is only true for machines expected to suffer SYNflood attacks.
	** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines		** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines
			*** Linux 2.6.26 added support for encoding some options into timestamps

			==Other Issues==
			* Only eight distinct [[TCP\|MSS]] values can be chosen, due to only three bits for MSS in the 32 bits of a SYNcookie

			==Other Mitigations for SYNfloods==
			* SYNproxying by a powerful intermediary

2009-06-11T01:48:33Z

← Older revision		Revision as of 01:48, 11 June 2009
Line 4:		Line 4:
	* "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."		* "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."
	** This is only true for machines expected to suffer SYNflood attacks.		** This is only true for machines expected to suffer SYNflood attacks.
	** The usefulness of TCP Large Window Extensions means I disable SYNcookies on internal machines		** The [[TCP\|usefulness of TCP Large Window Extensions]] means I disable SYNcookies on internal machines

2009-06-11T01:47:59Z

← Older revision		Revision as of 01:47, 11 June 2009
Line 1:		Line 1:
	DJB's page: http://cr.yp.to/syncookies.html		DJB's page: http://cr.yp.to/syncookies.html

			==Issues with DJB's Writeup==
			* "SYN cookies 'do not allow to use TCP extensions' such as large windows. Reality: SYN cookies don't hurt TCP extensions. A connection saved by SYN cookies can't use large windows; but the same is true without SYN cookies, because the connection would have been destroyed."
			** This is only true for machines expected to suffer SYNflood attacks.
			** The usefulness of TCP Large Window Extensions means I disable SYNcookies on internal machines

2009-06-11T01:46:06Z

Created page with 'DJB's page: http://cr.yp.to/syncookies.html'

New page

DJB's page: http://cr.yp.to/syncookies.html