logo
  • 前言

目录

  • Linux 内核
    • Interrupt Context and Process Context
    • Namespace
      • pid namespace
        • PID Namespace 的 Main process 结束 与 zombie child process
        • PID1 in containers
      • Network Namespace
        • Fun with network namespaces, part 1
    • Kernel Network
      • Kernel Network Data Struct
      • kernel network stack
        • Network Receive Path
        • bpf-trace-net-stack
        • TCP IP Architecture Design - Sameer Seth
        • Linux Network Stack Instrumentation Points
        • Understanding TCP/IP Network Stack & Writing Network Apps
      • Kernel TCP
        • tcp implementation
        • TCP Socket 缓存、接收窗口参数
        • tcp keepalive
        • TCP Reset 的原因
        • SYN Cookies
        • TCP Inspect
        • SO_LINGER socket opt
        • TCP TIME-WAIT
      • Socket
        • Socket 相关数据结构
        • Socket Buffer Queue
        • socket listen queues
        • Socket Close/Shutdown 的临界状态与异常逻辑
      • Kernel Routing
      • Netfilter
        • Nftables - Packet flow and Netfilter hooks in detail
      • conntrack
        • Connection tracking (conntrack) - Part 1: Modules and Hooks
        • Connection tracking (conntrack) - Part 2: Core Implementation
        • Connection tracking (conntrack) - Part 3: State and Examples
        • 连接跟踪（conntrack）：原理、应用及 Linux 内核实现
        • Network address translation part 4 – Conntrack troubleshooting
        • Out of Window Invalid Packet
        • NAT local port collision and SYN retransmit (NAT 分配端口冲突与 SYN 重传)
        • iptables Troubleshooting
        • Conntrack tales - one thousand and one flows
        • 定位 conntrack TCP RESET 问题
      • IPVS
      • ========= IP Sysctl
      • Documentation for /proc/sys/net/
    • Scheduler(调度器)
      • 调度点(Scheduler Point)
  • Kubernetes
    • Kubernetes Eviction
      • Out-of-memory (OOM) in Kubernetes – Part 4: Pod evictions, OOM scenarios and flows leading to them
    • Kubernetes Network
      • Kube Proxy
        • Cracking Kubernetes Node Proxy (aka kube-proxy)
    • Destructive test
      • What happens when one of your Kubernetes nodes fails?
    • Monitoring
      • Resource Monitoring
        • How to alert for Pod Restart & OOMKilled in Kubernetes
    • Pod
      • pod phase
    • Persistent Volumes
    • CSI
  • 可观察性 - Observability
    • Prometheus
      • Prometheus 基础知识
        • METRIC TYPES
        • Histograms 与 Summary 比较
        • Step and query_range - 步长与查询范围
        • Rate - 秒增量
        • Top
        • Metrics Design
        • rate vs increase functions
    • Log
      • Filebeat
      • Fluent Bit
        • 图解 Fluent Bit 内部设计
    • Node Exporter
      • Time metric - 发现时钟漂移
      • CPU frequency scaling metrics from the node exporter
      • Disk
    • Dashboard Best Practices
    • Java GC
    • eBPF based monitoring
  • Network
    • TCP
      • TCP Windows
        • Understanding Throughput and TCP Windows
      • TCP Ephemeral port
        • How to stop running out of ephemeral ports and start to love long-lived connections
        • Ephemeral port exhaustion and how to avoid it
      • Challenge ACK
    • TLS
      • TLS Handshake
      • 测试工具
      • ALPN
      • Cipher Suite(密码套件)
        • key exchange algorithm(密钥交换算法)
      • TLS Close Alert: close_notify
      • boringssl
      • Dump TLS(TLS 抓包)
    • Troubleshooting Tools
      • tcpdump
      • Wireshark
        • 用 Wireshark 分析 TCP Segmentation Offload (TSO)
    • HTTP
      • http 1.1
        • HTTP/1.1 Connection
  • Service Mesh
    • Envoy
      • TCP Proxy
      • Envoy Socket backlog
    • Istio
      • Istio mTLS
        • Istio mTLS 自动识别说明(Smartness Explained)
        • Understanding Istio’s Secure Naming
      • Metadata Exchange
        • TCP MX
        • metadata exchange plugin
      • Istio ALPN
        • istio-alpn-upstream
        • Istio ALPN Issues
      • Istio Gateway TCP Keepalive
      • Understanding TCP telemetry collection
      • Access Log
  • c 语言
    • libc
      • libc Stdout Buffering
  • 数据库
    • Cassandra
      • The Cassandra Architecture
      • Cassandra’s Data Model
      • Writing
      • Reading
      • Thread Pool
      • Data Files
      • Metrics
      • Client Drivers
  • Ceph
    • RADOS
    • krbd
      • Deep Dive Into Ceph’s Kernel Client
    • observability
      • prometheus module
      • Rook prometheus monitoring
  • 硬件
    • CPU
      • PMU counters and profiling basics
  • eBPF
    • libbpf
      • 图解 eBPF 基础库 libbpf 示例流程
  • 悟
    • Career
      • Jerks
        • 从《Why I Left Facebook》扯到蘇東坡《卜算子》
  • basic theory
    • The matter of time()
  • 底层技术
    • Linux ELF
      • ELF 格式简述
Theme by the Executable Book Project
  • .md
Contents
  • What is SYN Cookies
  • Ref

SYN Cookies

Contents

  • What is SYN Cookies
  • Ref

SYN Cookies#

What is SYN Cookies#

https://www.cnblogs.com/xiaolincoding/p/12995358.html?spm=a2c65.11461447.0.0.556649dfrnaZcc

开启 syncookies 功能

  • 深入浅出TCP中的SYN-Cookies
    • SYN Flood 攻击
    • 连接请求的关键信息
    • SYN cookies 算法
      • SYN Cookies 缺点
      • Linux 中的 SYN Cookies
      • SYN Cookies 与时间戳
    • 实验
      • 不开启 SYN Cookies
      • 有条件使用 SYN Cookies
    • 小结
    • REF

Ref#

  • https://wpbolt.com/syn-cookies-ate-my-dog-breaking-tcp-on-linux/

  • http://www.jauu.net/2010/06/24/tcp-window-scaling-and-syn-cookies/

  • Improving syncookies

  • kernel: Possible SYN flooding on port #. Sending cookies.

上一页

TCP Reset 的原因

下一页

深入浅出TCP中的SYN-Cookies

By Mark Zhu
© Copyright 2022, Mark Zhu.