Re: Connection Establishment

Henk Langeveld - NL <Henk.Langeveld@Sun.COM> Wed, 13 February 2002 15:49 UTC

Date: Wed, 13 Feb 2002 16:49:58 +0100
From: Henk Langeveld - NL <Henk.Langeveld@Sun.COM>
To: "Jeremy Harris [RU-UK]" <jgh@uk.sun.com>, tcp-impl@grc.nasa.gov
Subject: Re: Connection Establishment
Message-ID: <20020213164957.D15857@Sun.COM>
References: <200202131515.g1DFF7c10734@sunuk.UK.Sun.COM>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.4i
In-Reply-To: <200202131515.g1DFF7c10734@sunuk.UK.Sun.COM>; from jgh@uk.sun.com on Wed, Feb 13, 2002 at 03:16:03PM +0000
Sender: owner-tcp-impl@grc.nasa.gov
Precedence: bulk
Status: RO
Content-Length: 280
Lines: 7

Jeremy Harris [RU-UK]:
> I agree about the proper defence.  But parsing an http GET and searching
> a kernel URL cache isn't too expensive, and the eager action on it
> simple to disable when the system load it high or a SYN attack detected.

How do you detect a SYN attack?

Henk