Full Disclosure mailing list archives
Re: THC SSL DOS tool released
From: coderman <coderman () gmail com>
Date: Thu, 3 Nov 2011 19:17:31 -0700
On Wed, Nov 2, 2011 at 2:07 PM, coderman <coderman () gmail com> wrote:
... - cipher suite probing to find un-accelerated suites or more computationally expensive suites supported by a target.
a nice write up here covering relative costs of some suites, and more discussion on computation DoS: http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html suites clearly make a big difference (but you knew that already, right?) regarding concurrent connections stress, use >= 8G of memory on injector and: # in /etc/security/limits.conf : * soft nofile 65535 * hard nofile 2097152 # ... and ulimit -Hn 2097152 before launching load # in /etc/sysctl.conf : net.core.somaxconn = 2097152 net.ipv4.tcp_fin_timeout = 5 # or less # ... and sysctl -p /etc/sysctl.conf if you're routing through conntrack or equivalent facilities (this will cut your capacity in half) you also need to adjust conntrack limits. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: THC SSL DOS tool released Marsh Ray (Nov 01)
- Re: THC SSL DOS tool released coderman (Nov 01)
- Re: THC SSL DOS tool released Marc Heuse (Nov 02)
- Re: THC SSL DOS tool released coderman (Nov 02)
- Re: THC SSL DOS tool released coderman (Nov 03)
- Re: THC SSL DOS tool released Marc Heuse (Nov 02)
- Re: THC SSL DOS tool released coderman (Nov 01)