Thanks to all the reporters for the excellent work! This report - contains 28 entries and we hope you enjoy reading it.
+ contains 29 entries and we hope you enjoy reading it.The deadline for submissions covering between July and September 2013
@@ -1579,4 +1579,84 @@ functionality through pkg(8).
and CAP_RECV_RIGHTS.
+
+ We have had a SYN cookie implementation for quite some time now
+ but it has some limitations with current realities for window
+ scaling and SACK encoding the in the few available bits. This patch updates and improves SYN cookies mainly by: The common parameters used on TCP sessions have changed quite a
+ bit since SYN cookies very invented some 17 years ago. Today we
+ have a lot more bandwidth which makes the use window scaling
+ almost mandatory. Also SACK has become standard as it makes
+ recovering from packet loss much more efficient. The original SYN cookies method only stored an indexed MSS
+ values in the cookie. This obviously is not sufficient anymore
+ and breaks in the presence of WSCALE. WSCALE information is
+ only exchanged during SYN and SYN-ACK. If we cannot keep track
+ of it then we severely underestimate the available send or
+ receive window, compounded with the fact that with large window
+ scaling the window size information on the TCP segment header
+ would be even lower numerically. A number of years back SYN cookies have been extended to store
+ the additional state in the TCP timestamp fields, if available
+ on a connection. It has been adopted by Linux as well. While
+ timestamps are common among the BSD, Linux and other Unix
+ systems, Windows never enabled them by default, thus they are
+ not present for the vast majority of clients seen on the
+ Internet. The new improvement in this patch moves all necessary
+ information into the ISN again removing the need for timestamps.
+ Both the MSS and send WSCALE are stored in 3 bit indexed form
+ together with a single bit for SACK. While we cannot represent
+ all possible MSS and WSCALE values, both are 16 bit fields in
+ the TCP header, in only 3 bits each this, it turns out, is not
+ actually necessary. These improvements allow one to run with SYN cookies only on
+ Internet-facing servers. However while SYN cookies are
+ calculated and sent all the time, they are only used when the
+ syn cache overflows due to attacks or overload. In that cause
+ though, you can rest assured that no significant degradation in
+ TCP connection setup happens anymore and that even Windows
+ clients can make use of window scaling and SACK.
+
+
+