North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: TCP SYN attacks - a simple solution

  • From: Jeff Weisberg
  • Date: Mon Oct 07 09:41:46 1996 
| There have been several (many?) products attempting to solve the TCP
| SYN attack through timeouts. They watch the SYN packets, and flush
| ones, by doing a RESET on the connection if the third packet isn't
| received in time. Or letting conenctions fail by flushing the infant
| connection table when full. I believe this is wrong!
[...]
| I propose a solution where the initial sequence number is calculated
| (not random), and is based on a cryptographic calculation of the
| senders Initial Sequence Number, the ports, and a "per boot"
| secret number. In this way the initial packet can be discarded,
| and on receipt of the third SYN packet can be recalculated.

cool idea!

look at:
	ftp.op.net:/pub/src/syn-prophylactica/

for an implementation.

	--jeff

- - - - - - - - - - - - - - - - -