Re: [tcpm] TCP zero window timeout?

[Joe Touch <[e-mail]>]

MURALI BASHYAM wrote:
> It's
> possible that the authors did not have the potential
> of a DOS attack when they created this mechanism.

TCP does not itself defend from DOS attacks. If you want to prevent
that, run connections over IPsec.

...
> The resources in question are connections and buffers.
> Here we are talking potentially huge numbers of them
> (100000 connections and even if each connection holds
> 1 buffer, that's a lot of buffer memory). A mechanism
> to reclaim these resources  would have to take into
> account the duration of the persist state of the
> connections, it can't be done blindly.

TCP isn't there to clean up state. If old connection state is
interfering with new connections, and the connection isn't making
progress, the application layer (the layer that runs the buffers) can
tell. That's an application-layer timeout.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm