Firewall Wizards mailing list archives
Re: SYN flood protection strategies (Was: Post connection SYN)
From: Mikael Olsson <mikael.olsson () clavister com>
Date: Fri, 17 Oct 2003 17:40:54 +0200
Paul Robertson wrote:
Mikael Olsson wrote:OR you set up the firewall to answer SYNs on behalf of the server and wait for the handshake with the client to complete before doing the handshake with the server [...]You'd still want some sort of rate limit to stop floods and broken clients, unless you think a ring buffer solves that probelm? Otherwise, you've just moved flood protection from N servers to less than N firewalls, no?
I've moved the problem from servers with perhaps as low as 5 embryonic SYN sockets per port, that block for a full minute when the list is full, to a firewall that can handle hundreds of thousands of states, embryonic or not, and knows to nuke old embryonic SYNs when the state table is full. Yes, there are TCP stacks that handle SYN floods much better than what I described above (the linux crowd will undoubtedly cheer in with "all the world is a linux box!" here), but those that do handle it well enough on their own simply don't need the firewall to do SYN flood protection for them -- right? -- Mikael Olsson, Clavister AB Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden Phone: +46 (0)660 29 92 00 Mobile: +46 (0)70 26 222 05 Fax: +46 (0)660 122 50 WWW: http://www.clavister.com _______________________________________________ firewall-wizards mailing list firewall-wizards () honor icsalabs com http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- Post connection SYN Raghuveer (Oct 17)
- Re: Post connection SYN Mikael Olsson (Oct 17)
- Re: Post connection SYN Paul Robertson (Oct 17)
- Re: Post connection SYN Mikael Olsson (Oct 17)
- Re: Post connection SYN Paul Robertson (Oct 17)
- Re: SYN flood protection strategies (Was: Post connection SYN) Mikael Olsson (Oct 17)
- Re: SYN flood protection strategies (Was: Post connection SYN) Paul Robertson (Oct 17)
- Re: SYN flood protection strategies (Was: Post connectionSYN) Mikael Olsson (Oct 17)
- Re: SYN flood protection strategies (Was: Post connection SYN) Chuck Swiger (Oct 17)
- Re: SYN flood protection strategies (Was: Post connection SYN) Paul Robertson (Oct 17)
- Re: SYN flood protection strategies (Was: Post connection SYN) Chuck Swiger (Oct 17)
- Re: Post connection SYN Mikael Olsson (Oct 17)