Re: [PATCH] NET: Add TCP connection abort IOCTL

[David Miller <davem@davemloft.net>]

From: John Heffner <jheffner@psc.edu>
Date: Tue, 27 Mar 2007 20:27:44 -0400

> As a concrete example of a way I've used this type of feature is to 
> defend against a netkill [1] style attack, where the defense involves 
> making decisions about which connections to kill when memory gets 
> scarce.  It makes sense to do this with a system daemon, since an admin 
> might have an arbitrarily complicated policy as to which applications 
> and peers have priority for the memory.  This is too complicated to 
> distribute and enforce across all applications.  You could do this in 
> the kernel, but why if you don't have to?

On the contrary this sounds like an excellent task for
a netfilter based solution.