Subject: a question about SYN attack

From: william Li <[email-masked]>
Date: Tue, 12 Oct 1999 10:08:37 -0700

Hi Folks:

I want through the archive, and find out the summary
about the SYN flood attack from David Borman. Unfortunately
his summary(src) URL:
 
ftp://ftp.bsdi.com/contrib/bsdi_contrib/44Lite-SYNcache.gz)

is not accessible anymore and his e-mail [email-masked] can
not be reached either.

Is there an RFC for this problem ? 
Is there any solution (src) available ?

Very appreciated your help.

Subject: help
From: william Li <[email-masked]>
To: [email-masked]
Date: Mon, 11 Oct 1999 18:24:19 -0700

Hi David:

2 years ago, you have the infamous syn attack
resolved at:

ftp://ftp.bsdi.com/contrib/bsdi_contrib/44Lite-SYNcache.gz

Of course, the site is closed, could you
point out the new site? or mail me the
portion of the fix if possible.

Thanks,
-- 
Cheers

William Li
InterNetworking Systems, Lucent Technologies

---

From: David Borman <[email-masked]>
Date: Tue, 12 Oct 1999 22:28:21 -0500 (CDT)

William,

> is not accessible anymore and his e-mail [email-masked] can

BSDI is back on the air, after a 2 day outage.  Our ISP had a
broken backbone between POPs, and we were on the wrong side. :-(

Anyway, all of bsdi.com is now accessable again.  For the time
being, I've put a copy of the 44 SYN cache diffs up at:

	ftp://ftp.bsdi.com/private/44-syn-diffs.gz

			-David Borman, [email-masked]

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 12 Oct 1999 17:09:48 -0600 (MDT)

> This is the syn_cooky solusion. I believe that
> Vernon's random_drop solusion super-set this
> one. Does anyone have info about the radom_drop
> solusion ?

I think the syn-cooky solution was different, and neither a super-set,
sub-set, extension, or precursor of random-drop.  I also don't like it.

Exactly what is the question?

Dave Borman's solution can be viewed as a superset of random drop.  He
switched to a hash table to find TCB's, something that everyone who deals
with large numbers of sockets must do to avoid performance problems.  He
also changed things so that much less state is kept for each partly open
connection.  When that table overflowed, he picked an arbitrary,
reasonably random connection to throw out of the table.  That last bit
of picking a random connection to give up on instead of either the classic 
4.*BSD tactic of the newest connection or other systems' giving up on
the oldest connection is crux of random-drop.

Note that the idea of random-drop was suggested by a public note by
Robert Morris Jr.

Has something happened to BSDI?  Is there any reason to think that their
FTP site won't be back?  I can't reach them either, but it looks more like
a routing problem at about the nearest default free router from here
than a corporate dissolution.

Vernon Schryver    [email-masked]