Re: [tcpm] TCP zero window timeout?

[John Heffner <[e-mail]>]

I was looking at a similar problem a while ago as a result of a 
conversation with Stanislav Shalunov about his netkill 
(http://www.internet2.edu/~shalunov/netkill/) attack tool.  The netkill 
problem is different than the zero window problem (and simpler for the 
attacker, requiring less state), but the end result is essentially the 
same: the sender is forced to maintain data in the send buffer for a 
large number of connections, running the server out of memory.

Thinking about possible solutions, I didn't like the strictly TCP or 
strictly application solutions, for reasons already described on this 
list.  My favored approach was to write a daemon that accesses TCP state 
through instrumentation, applies a policy if memory is running low, and 
kills connections as appropriate by using the deleteTCB(12) state 
defined in the TCP MIB.  This does not require any additional protocol 
standardization.

I wrote a simple proof-of-concept python script (below) that utilizes 
the Web100 implementation of the TCP ESTATS MIB.  What it does 
essentially is if the system TCP send buffer memory is over some 
threshold value (100 MB), then it kills all connections that are over 
their fair share, and haven't made any forward progress in the last 
second.  There's clearly room for improvement, like more complicated 
policy (protect or favor certain applications, etc.), but it does defend 
against netkill, and should work for the zero-window attack as well.

   -John



import Web100
import time

agent = Web100.Web100Agent()

THRESH = 100 * 1024 *1024

omem = 0
conns = {}
while True:
     cmem = 0

     cl = agent.all_connections()
     for c in cl:
         state = c.read('State')
         try:
             old = conns[c.cid]
             if state == 1:
                 del(conns[c.cid])
             else:
                 cur = c.readall()

                 cmem = cmem + cur['CurAppWQueue']

                 if omem > THRESH and \
                    cur['SndUna'] == old['SndUna'] and \
                    cur['CurAppWQueue'] > THRESH / len(conns):
                     print("Deleting connection %d."%c.cid)
                     c.write('State', 12)

                 conns[c.cid] = cur

         except:
             # New connection.  Ignore if it's already closed.
             if state != 1:
                 conns[c.cid] = c.readall()
                 cmem = cmem + c.read('CurAppWQueue')

     omem = cmem
     time.sleep(1)

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm