1

I'm reading about how SYN flood can be prevented. Wikipedia has

Filtering
Increasing Backlog
Reducing SYN-RECEIVED Timer
Recycling the Oldest Half-Open TCP
SYN Cache
SYN cookies
Hybrid Approaches
Firewalls and Proxies

What exactly is meant by "filtering"? Is that like an ipfilter of known hackers?

What exactly is 'increasing backlog'? Does that just mean making more resources available?

What's a SYN cache? How can a cache work in this context, isn't it legitimate for the same client may need to open another connections with the same server?

Celeritas
  • 10,039
  • 22
  • 77
  • 144

1 Answers1

1

Maybe you should have added the line from Wikipedia preceding your list. There it states:

There are a number of well-known countermeasures listed in RFC 4987 including:

Thus the recommended way to get details to the items of the list is to look into the mentioned RFC.

What exactly is meant by "filtering"? Is that like an ipfilter of known hackers?

RFC 4987, 3.1 will tell you that this is about filtering incoming data based on the source address. So this is about either blacklisting known offenders or only allowing specific clients based on IP address (i.e. whitelist).

What exactly is 'increasing backlog'? Does that just mean making more resources available?

Yes, it will increase the backlog, i.e. how many connections are accepted by the host but not are not yet accepted by the application. But the relevant part in RFC 4987 will also tell you that this method causes additional performance problems at least with the implementations at the time the RFC was written.

What's a SYN cache? How can a cache work in this context, isn't it legitimate for the same client may need to open another connections with the same server?

Section 3.5 of the RFC will tell you that the concept is "best described by Lemon [Lem02]" but the section has also a good explanation of the concept itself. It essentially means that not the full state of a pending connection is stored at the server but only parts of it and thus it saves memory. It also replaces the socket based queue of incomplete connections with a system wide cache. I cannot see how it should cause problems with multiple connections from the same client.

See also What is the difference between SYN cookie, SYN cache, and SYN proxy?.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424