TCP Persist Timer DoS

TCP Persist Timer DoS

[Joel Becker]

Hey Netfolk,
	I have to assume you've seen
http://www.phrack.org/issues.html?issue=66&id=9&mode=txt.  Does anyone
have a plan or opinion on the DoS?  A way to mitigate it, a -EDONTCARE
opinion, anything?

Joel

-- 

"For every complex problem there exists a solution that is brief,
     concise, and totally wrong."
                                        -Unknown

Joel Becker
Principal Software Developer
Oracle
E-mail: joel.becker@oracle.com
Phone: (650) 506-8127

Re: TCP Persist Timer DoS

[David Miller]

From: Joel Becker <Joel.Becker@oracle.com>
Date: Fri, 19 Jun 2009 15:31:06 -0700

> Hey Netfolk,
> 	I have to assume you've seen
> http://www.phrack.org/issues.html?issue=66&id=9&mode=txt.  Does anyone
> have a plan or opinion on the DoS?  A way to mitigate it, a -EDONTCARE
> opinion, anything?

This is just like every other "DoS" out there where the attacker has
to reveal it's IP identity to accomplish the attack, in that it is
trivial to protect using netfilter by limiting the number of
connections a host can make with your system.

There are thousands of ways to open up a ton of TCP connections and
have them sit in a dormant state infinitely.

Nothing is really new here.

I noticed some amusing things in the threads discussing this: "Is it
just me or can pretty much every web site in the world get turned off
now?"

Ok, Chicken Little, the sky is falling.

Re: TCP Persist Timer DoS

[Joel Becker]

On Sat, Jun 20, 2009 at 01:05:14AM -0700, David Miller wrote:
> From: Joel Becker <Joel.Becker@oracle.com>
> Date: Fri, 19 Jun 2009 15:31:06 -0700
> 
> > Hey Netfolk,
> > 	I have to assume you've seen
> > http://www.phrack.org/issues.html?issue=66&id=9&mode=txt.  Does anyone
> > have a plan or opinion on the DoS?  A way to mitigate it, a -EDONTCARE
> > opinion, anything?
> 
> This is just like every other "DoS" out there where the attacker has
> to reveal it's IP identity to accomplish the attack, in that it is
> trivial to protect using netfilter by limiting the number of
> connections a host can make with your system.

	Thanks Dave, I knew there was a reason this wasn't all that
scary.

Joel

-- 

"Hell is oneself, hell is alone, the other figures in it, merely projections."
        - T. S. Eliot

Joel Becker
Principal Software Developer
Oracle
E-mail: joel.becker@oracle.com
Phone: (650) 506-8127