For those of you running Solaris 2.5, this can be done using ndd. The man
page and the "ndd /dev/tcp \?" command will get you started. You will have
to tweak the following variables "tcp_conn_req_max" and
"tcp_conn_grace_period". This will have roughly the same effects as Avi's
patches.
Avi's patches center around removing the limit on the size of the linked
list. With ndd, you can only raise the limit to 1024. Thus, the main
goal of Avi's patch is not possible.
On web servers, remote users routinely take longer than this to set up
connections. Anything less than 15-20 seconds and you will start loosing
hits from those ISP's that Metcalfe seems to frequent. This isn't a
criticism of Avi's patch. Its just something to be aware of.
Agreed. I would say that a good realistic limit is 30. Anything below
that and you WILL be kicking off valid connections. However, I would lower
it as soon as I knew I was being attacked.
> On a Sparc 1+ w/ 4.1.4, I could sustain a 200-400 SYN-packet/sec attack
> and still remain functional (and quick for a 1+), but the machine didn't
> normally run web servers... Even when I nailed it with 1000 SYNs/sec,
> the machine continued functioning but I couldn't connect to the socket
> being nailed. A second after stopping the heavier attack, I could.I have no idea what this will do for performance on Solaris 2.5 machines.
Well, the problem is that since you can only raise the limit to 1024, 200
SYN packets/sec would close up the socket being nailed in 5 seconds.
1000 SYNs/sec would nail the socket closed right away. (Well ok, in a little
over a sec.)
PS Does anyone have a good source of info on the Solaris implementation
for those of us not lucky enough to have source licenses?
Someone needs to make similar modifications to Solaris to remove the artificial
limit (assuming the Solaris implimentation does not have a hard limit (ie:
based on something like an array instead of a linked list.)
- Noam