Re: Enable syn cookies by default
From: Frans Pop <hidden>
Date: 2009-10-11 10:27:24
Also in:
lkml
Possibly related (same subject, not in this thread)
- 2009-11-13 · Re: Enable syn cookies by default · Olaf van der Spek <hidden>
- 2009-10-21 · Re: Enable syn cookies by default · Olaf van der Spek <hidden>
- 2009-10-21 · Re: Enable syn cookies by default · William Allen Simpson <hidden>
- 2009-10-21 · Re: Enable syn cookies by default · William Allen Simpson <hidden>
- 2009-10-21 · Re: Enable syn cookies by default · David Miller <davem@davemloft.net>
This question is better asked on the kernel network development list. Original mail from Olaf below. Cheers, FJP ================= Hi, I'm forwarding Debian feature request #520668. Could syn cookies be enabled by default? AFAIK syn cookies only get send when the half-open TCP connection queue is full. So stuff like window scaling should work fine in normal situations. Speaking of which: When the half-open TCP connection queue is full and syn cookies are enabled, you get a message like "kernel: possible SYN flooding on port 2710. Sending cookies." However when syn cookies are disabled, you don't get any message (in kern.log), although connections to your server are timing out. Could such a message be added? Maybe with a suggestion to increase the size of that queue or to enable syn cookies. Greetings, Olaf http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520668 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520667 https://bugs.launchpad.net/ubuntu/+bug/57091