Subject: Re: a question about SYN attack

From: Jason Thorpe <[email-masked]>
Date: Wed, 13 Oct 1999 10:38:10 -0700

On Wed, 13 Oct 1999 11:20:02 -0500 (CDT) 
 David Borman <[email-masked]> wrote:

 > I don't agree with NetBSD's decision to push all connections through
 > the SYN cache, as the SYN cache introduces a situation where valid
 > connections won't be established.  Specifically, we don't do retransmission
 > of the SYN/ACK out of the SYN cache (since it is assumed that when we
 > are under attack, retransmitting all the SYN/ACKs will take up a lot of
 > extra cycles for which there will be no benifit).  This means that if
 > we respond with a SYN/ACK to a valid connection, the returning ACK gets
 > lost, and there is no initial data coming from the client, then the
 > connection hangs, since ACKs are not retransmitted.

[ ...snip... ]

 > Has NetBSD done something to address this issue?

Yes.  A while back I added logic to handle transient unreachable-errors
and retransmit logic to the NetBSD SYN cache implementation.  I'm pretty
sure it's all in the 1.4.1 release (and may have also been in 1.4; I'm
not entirely certain, tho...)

When we decided to push all connections through the SYN cache, it really
helped clean up that code path; using both paths was quickly turning into
a real maintenance headache.

The net result (no pun intended :-) is that connections over a flaky network
continue to get through, even while the machine is being flooded at a high
rate.

        -- Jason R. Thorpe <[email-masked]>

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 13 Oct 1999 22:37:11 -0400

> not entirely certain, tho...)

It was definitely in 1.4 .. it got pulled onto the release branch
shortly before the release.

					- Bill

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 13 Oct 1999 22:37:11 -0400

- Bill

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 13 Oct 1999 22:37:11 -0400

- Bill