Subject: Re: a question about SYN attack

From: Vernon Schryver <[email-masked]>
Date: Tue, 12 Oct 1999 17:09:48 -0600 (MDT)

> From: william Li <[email-masked]>

> This is the syn_cooky solusion. I believe that
> Vernon's random_drop solusion super-set this
> one. Does anyone have info about the radom_drop
> solusion ?

I think the syn-cooky solution was different, and neither a super-set,
sub-set, extension, or precursor of random-drop.  I also don't like it.

Exactly what is the question?

Dave Borman's solution can be viewed as a superset of random drop.  He
switched to a hash table to find TCB's, something that everyone who deals
with large numbers of sockets must do to avoid performance problems.  He
also changed things so that much less state is kept for each partly open
connection.  When that table overflowed, he picked an arbitrary,
reasonably random connection to throw out of the table.  That last bit
of picking a random connection to give up on instead of either the classic 
4.*BSD tactic of the newest connection or other systems' giving up on
the oldest connection is crux of random-drop.

Note that the idea of random-drop was suggested by a public note by
Robert Morris Jr.

Has something happened to BSDI?  Is there any reason to think that their
FTP site won't be back?  I can't reach them either, but it looks more like
a routing problem at about the nearest default free router from here
than a corporate dissolution.

Vernon Schryver    [email-masked]

---

From: william Li <[email-masked]>
Date: Tue, 12 Oct 1999 18:10:29 -0700

Thanks, Vernon. You answered my question with 
the following comment.

BTW, netbsd has a syn_cache implementation:
    ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-1.4.1/source/

---

From: william Li <[email-masked]>
Date: Tue, 12 Oct 1999 18:10:29 -0700

---

From: william Li <[email-masked]>
Date: Tue, 12 Oct 1999 18:10:29 -0700