News for hackers. Stuff that matters.

A comment on SYN packet handling in the wild.

Re:SYN packet handling in the wild by phw on Thursday January 18, 2018 @10:26AM (#16177755)
If the SYN queue is more than half full, the kernel (used to?) adapts the number of SYN/ACK retransmissions to mitigate the load. Interestingly, this opens a side channel that can be determined remotely, and used to measure packet filtering world-wide. See Section 2.1 in: https://censorbib.nymity.ch/pdf/Ensafi2015a.pdf
[ Parent | on HN ]
Re:SYN packet handling in the wild by majke on Thursday January 18, 2018 @11:43AM (#16178509)
I'm quite sure this was removed in recent kernels, the "young" logic is now greatly simplified. Anyway - great paper. Thanks for digging it up.
[ Parent | on HN ]