Current Linux kernels include a facility called TCP SYN cookies, conceived to face SYN flooding attacks. However, the current implementation of SYN cookies does not support the negotiation of TCP options, although some of them are relevant for throughput performance, such as large windows or selective acknowledgment. In this paper we present an improvement of the SYN cookie protocol, using all the current mechanisms for generating and validating cookies while allowing connections negotiated with SYN cookies to set up and use any TCP options. The key idea is to exploit a kind of TCP connection called "simultaneous connection initiation" in order to lead client hosts to send together TCP options and SYN cookies to a server being attacked. Keywords: SYN flooding attacks, SYN cookies, TCP options, simultaneous connection initiation. Current Linux kernels include a facility called TCP SYN cookies, designed and first implemented by D. J. Bernstein and Eric Schenk [1, 2] . This facility was conceived to face a specific attack on normal TCP/IP networking, known as "SYN flooding attack". This is a denial-of-service attack that floods a server host with long-lasting half-open TCP connections. Since kernels usually restrict the number of half-open connections, a SYN flooding attack prevents real client hosts from connecting to a server host being attacked. Furthermore, such attacks are easy to deploy, can be launched anywhere on the Internet and are difficult to avoid by well-known servers. SYN cookies provide protection against this type of attack and their rationale is straightforward: prevent the denial-of-service scenario by not keeping state about pending connection requests, or half-open connections. The cookies allow a server host to maintain the state of half-open 1
TCP SYN cookies, improved in REF , may be considered as an IP-spoofing prevention although the method works only for TCP SYN flood attacks.
Improving The Functionality Of SYN Cookies
In Proc. IFIP TC6/TC11 Joint Working Conf. on Communications and Multimedia Security
Computer Science