Re: [RFC PATCH 2/2] tcp: Early SYN limit and SYN cookie handling to mitigate SYN floods

Hans Schillstrom
2012-05-31T15:32:04Z

On Thursday 31 May 2012 16:09:21 Eric Dumazet wrote:
> On Thu, 2012-05-31 at 10:45 +0200, Hans Schillstrom wrote:
>
> > I can see plenty "IPv4: dst cache overflow"
> >
>
> This is probably the most problematic problem in DDOS attacks.
>
> I have a patch for this problem.
>
> Idea is to not cache dst entries for following cases :
>
> 1) Input dst, if listener queue is full (syncookies possibly engaged)
>
> 2) Output dst of SYNACK messages.
>
Sound like a good idea,
if you need some testing just the patches

--
Regards
Hans Schillstrom <hans.schillstrom@ericsson.com>