Subject: Re: Questions on TCP backlog To: B. James Phillippe <>
From: der Mouse <mouse@Rodents.Montreal.QC.CA> List: tech-net
Date: 10/20/2001 06:08:04 > 2.) IPv4 TCP ~ general connection
request handling >       In any case, I'm trying to understand
the mechanism used to >       queue new connection requests.
Specifically, I am interested >       to know the design WRT SYN
flood type attacks against local >       sockets.  Is state
tracked for SYN's, or is there some kind of >       mechanism
similar to SYN cookies which obviates state tracking >
until the last stage of the 3WHS?  As I understand it, NetBSD
tracks state for SYNs; someone put a good deal of effort into it
and managed to get the per-nascent-connection overhead down to
some insanely low figure - what I remember is 4 bytes  No
stateless mechanism (like SYN cookies) can possibly conform to
the TCP spec, because SYN+ACKs will never be retransmitted
(which, it's fairly easy to see, can lead to connections
wedging, so this is a practical as well as strict-conformance
prob