From: Florian Weimer <fw@deneb.enyo.de>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: paul@clubi.ie, alan@lxorguk.ukuu.org.uk, vph@iki.fi,
toon@hout.vanvergehaald.nl, admin@wolfpaw.net,
kaukasoi@elektroni.ee.tut.fi, linux-kernel@vger.kernel.org
Subject: Re: Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack
Date: Tue, 21 Sep 2004 20:32:12 +0200 [thread overview]
Message-ID: <873c1bjwwj.fsf@deneb.enyo.de> (raw)
In-Reply-To: <E1C9aB6-0007Gk-00@gondolin.me.apana.org.au> (Herbert Xu's message of "Tue, 21 Sep 2004 12:14:48 +1000")
* Herbert Xu:
> Florian Weimer <fw@deneb.enyo.de> wrote:
>>
>>>> TCP-MD5 has no effect on ICMP based attacks.,
>>>
>>> Hmm, good point. Which attacks, and what could be done about them?
>>> (other than IPsec protect all traffic between peers).
>>
>> You just filter ICMP packets, in the way RST packets are already
>> filtered (i.e. rate limit).
>
> Rate-limiting has no effect on ICMP attacks unless your limit is such
> that you're effectively dropping them all.
Yes, that's the idea. Keep in mind that all this is about traffic
destined to a router interface address, not about forwarded traffic.
> But then you get PMTU problems...
PMTU discovery is not an issue because it's turned off anyway, at
least by default.
next prev parent reply other threads:[~2004-09-21 18:32 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <02a401c498e9$9167aff0$0300a8c0@s>
2004-09-12 17:29 ` Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial of Service Attack Wolfpaw - Dale Corse
2004-09-12 17:04 ` Alan Cox
2004-09-12 19:23 ` Toon van der Pas
2004-09-13 3:18 ` Paul Jakma
2004-09-13 3:30 ` Paul Jakma
2004-09-13 4:18 ` Willy Tarreau
2004-09-13 4:25 ` Paul Jakma
2004-09-13 19:07 ` Tonnerre
2004-09-13 19:18 ` Willy Tarreau
2004-09-13 19:25 ` Paul Jakma
2004-09-13 20:11 ` Ville Hallivuori
2004-09-14 14:55 ` Paul Jakma
2004-09-14 15:10 ` Alan Cox
2004-09-14 16:26 ` Paul Jakma
2004-09-14 16:09 ` Alan Cox
2004-09-14 17:17 ` Paul Jakma
2004-09-20 22:02 ` Florian Weimer
2004-09-21 2:14 ` Herbert Xu
2004-09-21 18:32 ` Florian Weimer [this message]
2004-09-21 19:56 ` David S. Miller
2004-09-21 20:04 ` Florian Weimer
2004-09-21 20:25 ` David S. Miller
2004-09-21 20:51 ` Florian Weimer
2004-09-14 19:41 ` Willy Tarreau
2004-09-14 18:56 ` Alan Cox
2004-09-20 22:03 ` Florian Weimer
2004-09-20 23:12 ` Alan Cox
[not found] <02bf01c498ff$b6512470$0300a8c0@s>
2004-09-12 19:42 ` Wolfpaw - Dale Corse
2004-09-12 19:53 ` Willy Tarreau
[not found] <02b001c498f6$7942bc50$0300a8c0@s>
2004-09-12 18:52 ` Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified)Denial " Wolfpaw - Dale Corse
2004-09-12 18:06 ` Alan Cox
[not found] <02b201c498f6$8bb92540$0300a8c0@s>
2004-09-12 18:40 ` Wolfpaw - Dale Corse
2004-09-12 18:01 ` Alan Cox
2004-09-12 19:48 ` Willy Tarreau
2004-09-13 6:59 ` Jurjen Oskam
[not found] <029201c498d8$dff156f0$0300a8c0@s>
2004-09-12 15:45 ` Linux 2.4.27 SECURITY BUG - TCP Local and REMOTE(verified) Denial " Wolfpaw - Dale Corse
2004-09-12 16:47 ` Petri Kaukasoina
2004-09-12 17:59 ` Willy Tarreau
2004-09-12 17:17 ` Alan Cox
2004-09-12 18:18 ` Willy Tarreau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=873c1bjwwj.fsf@deneb.enyo.de \
--to=fw@deneb.enyo.de \
--cc=admin@wolfpaw.net \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=herbert@gondor.apana.org.au \
--cc=kaukasoi@elektroni.ee.tut.fi \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@clubi.ie \
--cc=toon@hout.vanvergehaald.nl \
--cc=vph@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.