Re: Excellent host SYN-attack fix for BSD hosts

[mycroft () mit edu (Charles M. Hannum)]

Avi Freedman <freedman () netaxs com> writes:

> No state is kept locally; when a SYN is received, an ISS is generated that
> contains a few bits for reference into a table of MSS values; window size
> and any initial data is discarded; and the rest of the ISS is the MD5 output
> of a 32-byte secret and all of the interesting header info.

This doesn't seem to deal with window scaling, which is a big lose on
high-bandwidth networks.  It also breaks TCP's algorithm for
recognizing stale data.