TCP-Starvation
github.com
TCP-Starvation
1–10 of 17 posts
Re: TCP-Starvation
#2Is this similar to Slowloris at all?
Edit: With Slowloris it looks like the connection isn't closed client side though?
Although I'm just wondering they're dropping the FINs anyway.
Re: TCP-Starvation
#3This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers.
IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
Re: TCP-Starvation
#4It's a very old attack (~2000) named NAPTHA.
http://www.securiteam.com/securitynews/6B0031F0KA.html
Re: TCP-Starvation
#5Surprised by the amount of work done on the research but none(?) on past research on the same topic
Re: TCP-Starvation
#6It seems like the author thought his work was novel because he discovered using a firewall to stop a local client from sending FIN or RST. Of course, this is a triviality if you understand how to craft this type of attack using raw packets/custom TCP code.
Re: TCP-Starvation
#7This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers. IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
>IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
Works great until your users use an ISP that hands out /128 rather than /64
Re: TCP-Starvation
#8This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers. IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
>IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64. Works great until your users use an ISP that hands out /128 rather than /64
> ISP that hands out /128 rather than /64
Seriously? Who even hands out one single /64 or smaller? it's not like handing out /48s instead is going to deplete the IPv6 pool space [0].
[0] https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+e...
Re: TCP-Starvation
#9What is a good tool on Linux for testing such attacks?
Re: TCP-Starvation
#10Is this similar to Slowloris at all? Edit: With Slowloris it looks like the connection isn't closed client side though? Although I'm just wondering they're dropping the FINs anyway.
With Slowloris there are no missing TCP packets and client sends the correct request but VERY slowly.