Re: Altering the SOMAXCONN value.

[Mark Bauman <mlbauman@xxxxxxxxxxxx>]

Phil, 

Excerpts from mail: 22-Oct-97 Re: Altering the SOMAXCONN .. Phil
Hall@ssax.com (959*) 

> Working with Doc on this one, we've found that if you're really hammering a 
> listening process on the AS/400, that the backlog parameter needs to be 
>fairly 
> high to avoid the AS/400 randomly discarding queued connections. 

> The difference between AS/400 & Unix is that Unix will give you a 'Connection 
> refused' if the queued connection doesn't get serviced by an accept after a 
> certain time. The AS/400 on the other hand will randomly throw out a
> connection 
> (not necessarily your connection) from the queue. 

You are correct - we will randomly discard a connection on the listen
backlog queue if additional connection requests come in and the backlog
is full.  You are probably asking why?  It is due to the SYN denial of
service attack problem.  Basically, a hacker can overload a server with
connection requests and has (at least in some UNIX implementations and
some other server implementations I cannot mention) taken the servers
down!   The fix for the SYN attack is, among other things, to first go
thru and remove connection requests in a SYNRCVD state.  If there are no
SYNRCVD state connection requests in the backlog queue, then we randomly
remove an ESTABLISHED connection request in the backlog queue.  This
will NOT affect any connection that has been accepted() by the server
just the connection requests in the backlog.   

We are relooking at this SYN attack fix due to customer feedback we have
received. No promises of changes coming for it but we are relooking at
it.  

Doc, 

Excerpts from mail: 23-Oct-97 SOMAXCONN, etc... Ed.Doxtator@ssa.co.uk (2094*) 

> After speaking with IBM yesterday, it would appear that this will behaivour 
> will be treated as an OS/400 bug.  

I do not know who you talked to - it wasn't me unless it was thru
someone else and not to you directly ???  Anyway, we do not have an APAR
written on the random connection deletion that I know of.  As stated
above we are relooking at the SYN attack update.   


Mark L Bauman 
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
| Questions should be directed to the list owner/operator: david@midrange.com
+---