SYN Flooding [info] (fwd)

The attack is on! Both 2600 and Phrack, 2 of the biggest well-known
underground hacking magazines, have posted exploit code to do one of the
nastiest denial of service attacks that the Internet has seen so far.
Hundreds of people have access to these programs to bring down services on
the Internet. Many of these people are targeting their attacks at various
organizations such as ISP. Panix, an ISP, has been under attack for quite
a few days now and they have not been able to receive email. Many other

The reporting on these events has sucked big-time.
Panix couldn't receive mail for two multiple-hour periods.
After that, telnet and web ports were attacked.
We're not going to talk about implementations, but some solutions have
been implemented.

Alexis feels that it's very important to get wide press coverage, to
help to force ISPs/NSPs to filter outbound crap from their network.
I agree that everyone from the small to the large regional should do

Another way to fix this is to set the kernel maximum number of half open
connections allowed (SO_MAXCONN) to a higher number than the default value.

Or eliminate it; a Sparc 1+ has been able to handle over 1000 syns/sec
while still serving w/ no SO_MAXCONN (the test eliminated in the kernel)
and with the SYN timeout set to 7 seconds (a bit aggressive, we may use
15 seconds when we put these patches in permanently tomorrow).

We have a tool that will look for SYN packets that do not get followed with
ACK and clean the half open connections by sending a RST packet. This
unclogs the port and allows legitimate connections to happen. This tool
is called RealSecure (tm). To obtain a copy of the RealSecure tool,
send email to and within the body of the message, type:

  subscribe realsecure

RealSecure (tm) is a comprehensive attack recognition and real time response
tool that ISS is alpha testing and will expire in 60 days.

This sounds very good...
Maybe someone will even post a free, limited-function one as goodwill.

Christopher William Klaus Voice: (770)395-0150. Fax: (770)395-1972
Internet Security Systems, Inc. "Internet Scanner finds
Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
Web: Email: before the hackers do."


Alexis feels that it's very important to get wide press coverage, to
help to force ISPs/NSPs to filter outbound crap from their network.

While I agree with the goal here, I've been a bit disturbed by the
undercurrent of antipathy toward 'clueless small ISPs'. I'm as small
as ISPs come, and I've been outbound filtering against source
addresses not in my address space at least since last April. How many
of the clueful here can say that? Not many, I'll venture. For that
matter, when did Alexis begin filtering outbound?

I'd like the concept changed from 'forcing' to 'educating' and to have
it done without disparagement for not already knowing.