Re: SYN Flooding [info] (fwd)

[Avi Freedman <freedman () netaxs com>]

> The attack is on!  Both 2600 and Phrack, 2 of the biggest well-known
> underground hacking magazines, have posted exploit code to do one of the
> nastiest denial of service attacks that the Internet has seen so far. 
> Hundreds of people have access to these programs to bring down services on
> the Internet.  Many of these people are targeting their attacks at various
> organizations such as ISP.  Panix, an ISP, has been under attack for quite
> a few days now and they have not been able to receive email. Many other

The reporting on these events has sucked big-time.
Panix couldn't receive mail for two multiple-hour periods.
After that, telnet and web ports were attacked.
We're not going to talk about implementations, but some solutions have
been implemented.

Alexis feels that it's very important to get wide press coverage, to
help to force ISPs/NSPs to filter outbound crap from their network.
I agree that everyone from the small to the large regional should do
this.

> Another way to fix this is to set the kernel maximum number of half open
> connections allowed (SO_MAXCONN) to a higher number than the default value.

Or eliminate it; a Sparc 1+ has been able to handle over 1000 syns/sec 
while still serving w/ no SO_MAXCONN (the test eliminated in the kernel)
and with the SYN timeout set to 7 seconds (a bit aggressive, we may use
15 seconds when we put these patches in permanently tomorrow).

> We have a tool that will look for SYN packets that do not get followed with
> ACK and clean the half open connections by sending a RST packet.  This 
> unclogs the port and allows legitimate connections to happen.  This tool
> is called RealSecure (tm).  To obtain a copy of the RealSecure tool,
> send email to majordomo () Iss net and within the body of the message, type: 
>
>       subscribe realsecure
>
> RealSecure (tm) is a comprehensive attack recognition and real time response
> tool that ISS is alpha testing and will expire in 60 days.

This sounds very good...
Maybe someone will even post a free, limited-function one as goodwill.

> -- 
> Christopher William Klaus          Voice: (770)395-0150. Fax: (770)395-1972
> Internet Security Systems, Inc.                        "Internet Scanner finds
> Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
> Web: http://www.iss.net/  Email: cklaus () iss net        before the hackers do."

Avi
- - - - - - - - - - - - - - - - -