Re: resistance to swamping attacks.

[Robert Moskowitz <[e-mail]>]

At 12:30 PM 9/19/96 -0400, Bill Sommerfeld wrote:
>
>There have been a number of press reports about swamping attacks on
>TCP using forged source addresses.  Some of these press reports have
>suggested that IPv6 will solve all this by requiring authentication.
>
This is from the End-to-End list:

Date: Wed, 18 Sep 1996 14:32:14 -0600
From: [e-mail] (Vernon Schryver)
To: [e-mail]
Subject: SYN bombing defense
Sender: [e-mail]

As reported here, in article <[e-mail]>
in comp.protocols.tcp-ip, Robert Morris  <[e-mail]>
wrote:

>Perhaps TCP's listen queue should use random early drop (RED), a
>technique used by routers to prevent any one source from monopolizing
>a queue. See http://www-nrg.ee.lbl.gov/floyd/abstracts.html#FJ93 or
>rfc1254.
> ...

I've just hacked IRIX 6.3 to do random-drop when sonewconn() in
tcp_input.c fails.  It works great!  An IP22 receiving 1200 bogus
SYN's per second directed to port 23 continues to answer requests
for new telnet as if nothing is happening.

I don't think that random <<Early>> drop is necessary or desirable.
It is not as if we're trying to drop packets early to trigger
slow start in the sources.

As I figure it, as long as the length of the queue is longer than RTT
of the real telnet client times the rate of bogus SYNs, the real
clients have an excellent probability of getting through on their
first attempt.  For example, at 1200 bogus SYNs/sec and the IRIX 6.3
telnet listen queue of 383, there should be no trouble with peers
with RTT up to about 300 milliseconds.  I've tested with a telnet
client 250 milliseconds away while simultaneously bombing the machine
from nearby with ~1200 SYNs/sec, and see no telnet TCP retransmissions.


Vernon Schryver,  [e-mail]



Robert Moskowitz
Chrysler Corporation
[phone]