freebsd 6 deny ddos

最新推荐文章于 2023-07-04 22:16:51 发布

原创最新推荐文章于 2023-07-04 22:16:51 发布 · 373 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#freebsd

本文探讨了FreeBSD系统如何通过syncache和syncookie两种机制来抵御SYN洪水攻击。即使关闭syncookie功能，系统似乎仍然使用该机制进行防御。

Yesterday, I have a test on FreeBSD 6 with synflooding. FreeBSD behaved very well but strange.

Though net.inet.tcp.syncookies is on by default, I set it to zero to disable syncookie, it seems that the FreeBSD was still using syncookie. I don't know if it's the normal operation. I'll do some dig into the source to see what will happen when set the MIB to 0.

After all, you should enable device polling before any other operations.

I've explored the source code. FreeBSD has implemented two mechanisms in the kernel, one is syncache, the other is syncookie. If you tuned syncookie on, the kernel will firstly find the matching entry in the syncache when received ACK packets, if no matching entry found, the kernel will do a check on the returned SN. If you turned the syncookie off, you will probably sufferring from the synflood (D)?DOS attack