RE: syn DDoS attack solution

["Ric Messier" <kilroy@WasHere.COM>]

Bgs writes:
> 
> Some more info about the attack: All IPs were real IPs otherway the tcp
> handshake wouldn't have made it. The attacker IPs were also consistent.
> They also new about the blocked IPs as after a new bunch of blocked IPs
> we fared OK then they added another bunch new IPs... we played this for
> quite some time...
> 
> All connections were in the ESTABLISHED state.
> 

Then your original description was incorrect or at least inadequate. It has
nothing to do with SYN as originally suggested since an ESTABLISHED
connection has blown past SYN, through SYN/ACK and by ACK. It has completed
the TCP handshake, as you note above. A SYN attack/flood would stop after
sending the initial SYN and leave the connection half-open to exhaust the
half-open buffers.

> 
> How is the handling of ESTABLISHED connections implemented in the
> TCP/IP
> stack?

There is likely a timer somewhere to time out connections that are just
hanging around doing nothing. You'd have to dig around to find it and turn
it down. You could also use something like tcpkill to get rid of them for
you. 


Ric