Re: RST not emitted on listen backlog full?

[Steven Bellovin <smb%cs.columbia.edu@localhost>]

On May 11, 2010, at 12:26 24PM, Chuck Swiger wrote:

> On May 11, 2010, at 8:34 AM, Michael Richardson wrote:
>> I think the behaviour (TCP RST vs retransit) needs to be sysctl'able, or 
>> setsockopt()able.
> 
> There's already SO_RCVTIMEO for setsockopt() which should be usable for the 
> purpose on the client side...?
> 
> The thing is, RFC-793 is pretty clear about when to RST and when not to.  
> You're supposed to RST connection attempt requests when you know they are 
> invalid (ie, to a port which is closed and so forth); but there is nothing 
> which suggests it's OK to RST for a valid connection attempt to an open 
> port-- see the "SEGMENT ARRIVES" section.

I mostly agree.  The question is whether an RST is a better response if you're 
enduring a SYN flood attack.  I suspect that the answer is that it doesn't 
matter much, since the bad guys will just keep sending, but it does bear a bit 
more thought.

                --Steve Bellovin, http://www.cs.columbia.edu/~smb