Re: [PATCH] Increased DoS protection.

[Andi Kleen <ak@xxxxxx>]

On Fri, Apr 28, 2000 at 04:10:55AM +0200, Rusty Russell wrote:
> 
> This leaves it vulnerable to SYN floods (as is the old masquerading
> code, so we didn't get *worse* here): long term I will implement
> window tracking as per ipfilter, and then I can be more confident that
> a real three-way handshake has occurred, and set a high-confidence bit
> for that connection.

It is still hard when you consider reboots. The 3way handshake is long gone.
Simply checking for an ACK from inside is not enough, because TCP generally 
acks all out of window packets (so it would be easy to fool from an attacker
who guesses ports) On other connections you'll only see legitimate ACKs
from one end, so checking for more than just an ack doesn't work neither.
How do you plan to handle that problem? Forget connections on reboot ? 

-Andi