Subject: Re: [Ieprep] Re: some 9/11 stats

From: Scott Bradner <[email-masked]>
Date: Sat, 12 Jan 2002 15:10:33 -0500 (EST)

> I tend to think that the simplest approach under extreme load is to make 
> SYN/SYN-ACK processing be lowest priority

you could also RED them - if there is an attack then the attacking SYNs
will be more likely to be dropped

Scott

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Fred Baker <[email-masked]>
Date: Sat, 12 Jan 2002 12:40:02 -0800

>will be more likely to be dropped

RED is an equal opportunity dropper/marker of traffic in a queue. You would 
use RED on the queue that the SYNs were in, and that would be a good thing. 
But RED in and of itself won't attack SYNs any harder than anything else 
unless the SYNs are somehow targeted, such as pulling them out to their own 
queue.

The issue there is that SYNs are small packets (the only information they 
contain, really, is that some system wants to open a TCP connection to a 
listening socket), and represent a small fraction of packets - if a typical 
TCP session is ten packets each way or more, then SYNs represent 10% of 
traffic each way or less. Simply applying RED will hit data stream packets 
as well, and frankly you'd like to get them through in order to clear out 
the sessions.