RE: Syn floods and DOS protection

[Julian Anastasov <ja@xxxxxx>]

        Hello,

On Tue, 3 Sep 2002, Peter Mueller wrote:

> >     Another option can be a QoS policer limiting the SYN rate.
> > You can use it at any place before the real servers (gateway,
> > director). There is example for such settings in the iproute2
> > package.
>
> This sounds very interesting.  Does the QOS synrate limiter differentiate
> between "real" and "fake" traffic at all?  Do you have any Julian tips on

        No, there is no differentiation. But such policer is a must in
situations where we don't want to reply to each SYN and to overload
our out line with SYN cookies.

> their usage? :D

        Nothing special, examples/SYN-DoS.rate.limit

Regards

--
Julian Anastasov <ja@xxxxxx>