SYN Flooding - hp_syn_protect on HP-UX 11i or 11.00

[Michele (Mike) Alberton]

Hi Folks,
we've been requested by one of our customers to detail HP-UX reaction to SYN flooding attacks.
I found about the hp_syn_protect kernel parameter in some old security bulletin, but nothing more recent than 1999.
Which is the current status for this issue ? I could not find the parameter within the Kernel configurable list, so that I was wondering if something else have been implemented.

Thanks !

Mike

[Paula J Frazer-Campbell · Accepted solution]

Hi

http://www.ciac.org/ciac/bulletins/h-50.shtml

I know this is a 1997 doc but it is still relevent.



Paula

[Paula J Frazer-Campbell]

Hi

This more up to date and deals with 11.00

http://www.securityfocus.com/infocus/1729

Paula

[Michele (Mike) Alberton]

Cool !

I got into the same documentation while waiting !

:-)

Good points to both, thanks !

mike

[donne007]

Hi,
Good Stuf By the one posted Earlier.
Hope this may of some help,, http://www1.itrc.hp.com/service/cki/secBullArchive.do
AS ther are some Libthread patched released for Dos/SYB_Flooding

Cheers
Asif

[Rich Antonick]

You should also take a look at ndd(1m) and its tcp_syn_rcvd_max parameter.

Rich