From: Stephen Hemminger <shemminger@vyatta.com>
To: Mikael Abrahamsson <swmike@swm.pp.se>
Cc: Joe Buehler <aspam@cox.net>,
Eric Dumazet <eric.dumazet@gmail.com>,
netdev@vger.kernel.org
Subject: Re: DSCP values in TCP handshake
Date: Mon, 18 Apr 2011 21:16:37 -0700 [thread overview]
Message-ID: <20110418211637.57f1cfb8@nehalam> (raw)
In-Reply-To: <alpine.DEB.2.00.1104190547300.14027@uplift.swm.pp.se>
On Tue, 19 Apr 2011 05:50:34 +0200 (CEST)
Mikael Abrahamsson <swmike@swm.pp.se> wrote:
> On Mon, 18 Apr 2011, Stephen Hemminger wrote:
>
> > If the DSCP bits are reflected, then it could allow for even better SYN
> > flood attack. Attacker could maliciously set DSCP to elevate priority
> > processing of his bogus SYN packets and also cause SYN-ACK on reverse
> > path to also take priority.
>
> Incoming, it's already too late. Outgoing, yes, that might be a problem,
> but if you have a QoS enabled network then you might as well solve that in
> the network, not in the host.
>
> Does Linux internally look at DSCP when deciding what SYNs to handle
> first? If not, I think the above reasoning is misdirected.
Linux does not look at DSCP of incoming packets (there is no queue).
Of course, you can do anything with qdisc, and iptables.
next prev parent reply other threads:[~2011-04-19 4:16 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-04-18 13:48 DSCP values in TCP handshake Joe Buehler
2011-04-18 14:05 ` Eric Dumazet
2011-04-18 15:38 ` Stephen Hemminger
2011-04-18 15:57 ` Mikael Abrahamsson
2011-04-18 19:01 ` Joe Buehler
2011-04-18 19:16 ` Mikael Abrahamsson
2011-04-18 21:49 ` Stephen Hemminger
2011-04-19 3:50 ` Mikael Abrahamsson
2011-04-19 4:16 ` Stephen Hemminger [this message]
2011-04-19 4:28 ` Mikael Abrahamsson
2011-04-19 15:09 ` Matt Mathis
2011-04-19 17:38 ` Mikael Abrahamsson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110418211637.57f1cfb8@nehalam \
--to=shemminger@vyatta.com \
--cc=aspam@cox.net \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=swmike@swm.pp.se \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).