Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by ynik on Tuesday October 10, 2023 @08:47PM
(#37839670)
I wonder why exactly this attack can't be pulled off with HTTP/1.1 and TCP RST for cancellation.
It seems that (even with SYN cookies involved) an attacker could create new connections, send HTTP request, then quickly after send a RST.
Is it just that the kernel doesn't really communicate TCP RST all that well to the application, so the HTTP server continues to count the connection against the "open connection limit" even though it isn't open anymore?
Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by wbl on Tuesday October 10, 2023 @09:39PM
(#37839983)
The problem for the attacker is they then run into resource limits on the TCP connections. The resets are essential to get the consumption not counting.
Is it just that the kernel doesn't really communicate TCP RST all that well to the application, so the HTTP server continues to count the connection against the "open connection limit" even though it isn't open anymore?