slides30

Question 1

ddos remedies

Answer 1

Remedies include the server starting to drop half-open connections when resources are low

Question 2

wat syncookies

Answer 2

Alternatively, use syncookies
Store no information on the server, but encode it in the server’s
initial sequence number (ISN) for this connection
So the ISN is not random, but now encodes some information:
it is called a syncookie
When (or if!) the client ACK gets back, we can decode the
returned sequence number to retrieve the information
Now resources can safely be allocated to this presumably valid connection
This is good as it consumes no resources in the server until they are definitely needed

Question 3

wat Fragment bombs

Answer 3

Too many fragments for packets that are never completed and
so can’t be reassembled
This overflows fragment buffer space (where fragments are kept pending reassembly) and likely causes a denial of service, even a crash

Question 4

wat the ping of death

Answer 4

These were sent as forged fragments that, when reassembled, were much larger than expected and overflowed OS buffers in the receiving host
The usual result is a crash: another denial of service

Question 5

were du de malevolent tings originate from

Answer 5

Usually from the implementers making invalid assumptions about IP and assuming packets are all well-formed and correct