Re: DoS attack against TCP services

[Robert Elz <kre%munnari.OZ.AU@localhost>]

    Date:        Wed, 4 Feb 2015 23:27:39 +0100 (CET)
    From:        6bone%6bone.informatik.uni-leipzig.de@localhost
    Message-ID:  <Pine.NEB.4.64.1502042315490.812%6bone.informatik.uni-leipzig.de@localhost>

  | I'm afraid I have chosen the wrong subject. After some testing, I found 
  | that all tcp connections go in the TIME_WAIT state.

It would be all TCP connections that are first closed by your system,
(ones closed first by the remote, like some HTTP connections, skip TIME_WAIT
at your end).

The problem to me "smells" very much like there's some problem with the
kernel's internal timer operations - or related - something isn't
processing time correctly.

What's more, it seems peculiar to your system, as no-one else seems to
be reporting similar problems.   So I'd be investigating how the timers
are working (or are not working) in the kernel - perhaps even try
selecting a different timer.

I assume that time (as seen from user processes) is functioning correctly?

kre