Re: Repeat sequence number on TCP with SYN bit

[Joseph Mack <mack@xxxxxxxxxxx>]

On Thu, 10 Aug 2000, Kyle Sparger wrote:

nice idea. what are the sequence numbers in a SYN flood attack?

Joe

> It occured to me that if we were to keep track of not only SYNs, but their
> sequence numbers, we could possibly very easily detect when a TCP based
> real server is having problems by noticing that we've seen that sequence
> number in a SYN from that host not too long ago, and either remove that
> server from the pool, or (more likely) notify userspace for appropriate
> handling.

--
Joseph Mack mack@xxxxxxxxxxx