Re: denial of service attack possible

[darrell () teleport com (Darrell Fuhriman)]

On Fri, 27 Oct 1995, Mark Thomas wrote:

> If anyone has any more specifics on this problem, please let me know.  When
> the server is healthy netstat indicates a couple SYN_RCVD state services, but
> they never last from one netstat command to another for the same remote IP.

SunOS 4.1.4 only allows five listen()s to be quueud up per port.  (You can
put any number in the function call it's quietly set to five anyway.)
Solaris 2.4 allows 32 queued, 2.5 will allow 1024.  Don't expect Sun to
be doing anything with 4.1.4 to fix it though.  It's hard enough to get a
syslog patch out of them.  :(

One possible way to fix it, is to try turning on SO_KEEPALIVE, and
turning down tcp_keepintvl in the kernel (150 seconds is default).

No guarantees though.

Darrell Fuhriman