Re: Any known IP DoS in 2.1.129?

Michael H. Warfield (mhw@wittsend.com)
Sun, 22 Nov 1998 11:08:14 -0500 (EST)


Chip Salzenberg enscribed thusly:
> A server I'm responsible for is running 2.1.129 plus the UP Flu patch,
> and yet it keeps dying without log messages.

> I have verified that this server has been attacked by Skript Kiddeez
> in the past, because the SYN Cookie feature trapped and logged several
> SYN floods (thanks for SYN Cookies!). But I don't know if they're
> still attacking it with something I haven't heard of, or if the kernel
> is just crashing for other reasons.

I heard of someone else who claimed that 129 was susceptable to one
of the teardrop varients, newtear specifically. I just heard about this
yesterday and haven't had a chance to retest this or test it against
teardrop or boink (the original and another varient). Consider it an
unconfirmed rumor. I will post back later if my testing turns up anything.

If anyone else has any specifics, please chime in.

> It's compiled for UP, running on a Pentium II, 64M, aic7xxx SCSI
> disk, no IDE at all. Help?
> --
> Chip Salzenberg - a.k.a. - <chip@perlsupport.com>
> "There -- we made them swerve slightly!" //MST3K

Mike

-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com
  (The Mad Wizard)      |  (770) 925-8248   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/