Date: Sun, 23 Jan 2000 10:28:30 -0500 From: Richard Steenbergen <ras@above.net> To: freebsd-security@freebsd.org Subject: stream.c Message-ID: <20000123102829.C18349@above.net>
next in thread | raw e-mail | index | archive | help
Sigh... ok, just to help out those people running around like chickens with their heads cut off trying to fix or simulate the freaking stream.c garbage: "netstat 1" is your friend... and if its not putting out as many packets/sec as it should be, look to your network connection. Half duplex hubs will become quickly unhappy and backup transmition to the point of getting those lovely out of buffer space messages. I think this has disappointed quite a few packet kiddies already, since half the time the only thing they end up killing is the place they're attacking from. :P The correct "sorta-fix" is to rate limit the number of dropwithreset's per second, else kick them down to straight drop. I believe this has been done effectively in http://www.freebsd.org/~alfred/tcp_fix.diff (though I question what its aimed to be accomplished with that checksum work :P). And note the fact that since it was originally not intended to be an ACK flooder, the ack # field itself stays 0. Think about it. Also note that there are at least two versions floating around out there, one with the TH_ACK bit set (the original copy passed around to the packet kiddies) and one with no flags set (the copy the idiot that passed it out in the first place continued to pass out to new people after all the hoopla over the first release). yada yada hope this helps someone, I'm so sick of stream.c its not even funny. -- Richard A. Steenbergen <ras@above.net> http://users.quadrunner.com/humble PGP Key ID: 0x60AB0AD1 (E5 35 10 1D DE 7D 8C A7 09 1C 80 8B AF B9 77 BB) AboveNet Communications - AboveSecure Network Security Engineer, Vienna VA "A mind is like a parachute, it works best when open." -- Unknown To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000123102829.C18349>