TCP Reset

[michael.porter () hushmail com]

Hi,

What does the group think of the benefits of killing TCP connections, as 
available in FLEXRESP, or even the Tcpkill feature in ISS Realsecure?

> From what I've understood so far, it's effective against DoS attacks like 
SYN-Flood, and of limited value against buffer overflow attacks; plus, it 
could be abused by the attacker too.

Since the 'Reset' is sent after the attack packet reaches the host, can 
it actually prevent the buffer overflow? Now, if the malicious code that 
gets executed adds a new account (say), wouldn't killing the connection 
after the event be quite wasted?

TIA,

Michael
Free, encrypted, secure Web-based email at www.hushmail.com