flood SYN attack

Wolfram Kleff (kleff@athene.informatik.uni-bonn.de)
Sun, 22 Sep 1996 17:03:28 +0200 (MET DST)

> > The problem with kernel 2.0.20 is the fact that the kernel consumes
> > extremely much load while it is attacked. (up to 10.0 - it can't even
> > recognice a keypress)
>
> Quite often you can't stop that. If you hit most PC's with say tulip cards
> flat out at 100baseT even a pentium 133 near enough stops dead because
> the network bus traffic about equals the ram bandwidth!)

The network food traffic can't be the problem - that would be a normal flood
attack. For example the ICMP ECHO flood attack slows down the computer,
but it is far away from being unusable. The flood SYN attack completely
locks up the computer while being attacked.

> > I suppose that the actual implementation of the timing code for the SYN
> > timeout is too slow ?
>
> It shouldn't be. Interesting. If you want to send me the code you use please do.

Experiments with an old 2.0.0 kernel shows that there is no lockup.
Hopefully that might be interesting.

Wolfram