Check out the new USENIX Web site. next up previous
Next: Further Work and Conclusion Up: Resisting SYN flood DoS Previous: Round trip performance

Previous Work

David Borman wrote a patch for BSDi which implemented a SYN cache in October 1996, which was released as an official BSDi patch [2]. This implementation used the cache only as a fallback mechanism in case the listen queue overflowed, and did not retransmit the SYN,ACK to the peer. The justification given was that since the host was under attack, performing retransmits would be a waste of CPU time [3].

This code was incorporated into NetBSD[5] in May 1997 and subsequently enhanced to perform retransmits, as well as having the cache handle all incoming connections, instead of only those which overflow the listen queue. The implementation described in this paper bears a strong resemblance to their existing code.

An alternate approach was taken by Linux, which chose to incorporate syncookies[1] as their defense against this style of attack. On these systems, the syncookie defense mechanism engages only when the normal listen queue overflows.



Jonathan Lemon 2001-12-04