Re: Naptha - New DoS

[Filipe Almeida <filipe () IST UTL PT>]

On Fri, Dec 08, 2000 at 11:18:53PM -0600, Damian Menscher wrote:
> Now for a question: the effectiveness of the attack comes from the fact
> that the attacker doesn't need to store the state.  Why not just allow
> the second machine to actually exist, but not store the state?  Saves
> effort from sniffing, though it does make it easier to find and shut
> down.....

        When the SYN/ACK comes back from the victim machine, your tcp/ip stack
will respond with a RST.

        You will have an extra effort preventing RST and FIN packets
leaving the attacker machine as a response to the fake connections you just
opened.  Unless you filter outgoing RST and FIN packets, but then, you won't
be able to terminate your own legit connections.

        Another option is to reserve a port range where you filter all outgoing
RST and FIN packets and serve as the source port of your attack.

--
Filipe Almeida
aka
LiquidK