IMPROVING THE FUNCTIONALITY OF SYN COOKIES

Abstract

Current Linux kernels include a facility called TCP SYN cookies, con-ceived to face SYN flooding attacks. However, the current implementation of SYN cookies does not support the negotiation of TCP options, although some of them are relevant for throughput performance, such as large windows or selective acknowledgment. In this paper we present an improvement of the SYN cookie protocol, using all the current mechanisms for generating and validating cookies while allowing connections negotiated with SYN cookies to set up and use any TCP options. The key idea is to exploit a kind of TCP connection called "simultaneous connection initiation" in order to lead client hosts to send together TCP options and SYN cookies to a server being attacked.