From owner-FreeBSD-net-jp@jp.freebsd.org  Sun May  6 19:43:33 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id TAA93116;
	Sun, 6 May 2001 19:43:33 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from seiryu.es.hkg.ac.jp (seiryu.es.hkg.ac.jp [202.25.195.129])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id TAA93108
	for <freebsd-net-jp@jp.freebsd.org>; Sun, 6 May 2001 19:43:32 +0900 (JST)
	(envelope-from harrier@seiryu.es.hkg.ac.jp)
Received: from localhost (localhost [127.0.0.1])
	by seiryu.es.hkg.ac.jp (8.11.3/3.7W) with ESMTP id f46AhVm29514;
	Sun, 6 May 2001 19:43:32 +0900 (JST)
To: freebsd-net-jp@jp.freebsd.org
Cc: harrier@seiryu.es.hkg.ac.jp
X-Mailer: Mew version 1.93 on Emacs 19.34 / Mule 2.3 (SUETSUMUHANA)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Message-Id: <20010506194331E.harrier@seiryu.es.hkg.ac.jp>
Date: Sun, 06 May 2001 19:43:31 +0900
From: Hiroyuki Une <harrier@seiryu.es.hkg.ac.jp>
X-Dispatcher: imput version 980905(IM100)
Lines: 48
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+010328
X-Sequence: FreeBSD-net-jp 3091
Subject: [FreeBSD-net-jp 3091] FIN flooding?
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: harrier@seiryu.es.hkg.ac.jp

$B1-:,!w9-Eg9q:]3X1!Bg3X$G$9!#(B
$B2H$N%^%7%s$+$i$H$"$k(B Web $B%5!<%P$KBP$7$F(B
FIN Flooding $B$H$7$+$$$$$h$&$N$J$$8=>]$,5/$-$^$7$?!#(B
tcpdump(8) $B$N7k2L$r0J2<$K<($7$^$9!#(B
$B!t(Bmyhost $B$,2H$N%^%7%s!"(Bwwwserver $B$,@\B3@h$N%5!<%P$r<($7$^$9!#(B

------ $B$3$3$+$i(B
02:18:04.948680 myhost.1053 > wwwserver.http: S 2562081605:2562081605(0) win 16384 <mss 1460> (DF)
02:18:05.123802 wwwserver.http > myhost.1053: S 215310319:215310319(0) ack 2562081606 win 32120 <mss 1460> (DF)
02:18:05.123929 myhost.1053 > wwwserver.http: . ack 1 win 17520 (DF)
02:18:05.124244 myhost.1053 > wwwserver.http: P 1:331(330) ack 1 win 17520 (DF)
02:18:05.914819 wwwserver.http > myhost.1053: . ack 331 win 31790 (DF)
02:18:05.964830 wwwserver.http > myhost.1053: P 1:599(598) ack 331 win 32120 (DF)
02:18:05.974798 wwwserver.http > myhost.1053: F 599:599(0) ack 331 win 32120 (DF)
02:18:05.974876 myhost.1053 > wwwserver.http: . ack 600 win 17182 (DF)
02:18:06.037180 myhost.1053 > wwwserver.http: F 331:331(0) ack 600 win 17520 (DF)
02:18:07.154688 myhost.1053 > wwwserver.http: F 331:331(0) ack 600 win 17520 (DF)
02:18:07.980659 wwwserver.http > myhost.1053: . ack 4170085203 win 32120
02:18:07.980696 myhost.1053 > wwwserver.http: F 331:331(0) ack 600 win 17520 (DF)
02:18:08.114897 wwwserver.http > myhost.1053: . ack 4170085203 win 32120
02:18:08.114934 myhost.1053 > wwwserver.http: F 331:331(0) ack 600 win 17520 (DF)
02:18:08.490359 wwwserver.http > myhost.1053: . ack 4170085203 win 32120

	($B0J2<:G8e$NFs9T7+$jJV$7(B)
------ $B$3$3$^$G(B

$B$3$l$r8+$k8B$j!"2H$N%^%7%s$,Aw=P$7$?(B FIN $B%Q%1%C%H$KBP$7$F(B
$B8+Ev30$l$N%7!<%1%s%9HV9f$N$D$$$?(B ACK $B%Q%1%C%H$,(B
$BJV$C$F$$$k$?$a!"4|BT$7$?%7!<%1%s%9HV9f$N(B ACK $B%Q%1%C%H$,(B
$BJV$C$F$/$k$^$G(B FIN $B%Q%1%C%H$rAw=P$7B3$1$k$h$&$G$9!#(B
$B$3$l$,7k2L$H$7$F(B FIN Flodding $B$r0z$-5/$3$7$F$$$k860x$G$9!#(B
$B$3$N8=>]$O%^%7%s$r%j%V!<%H$9$k$^$GB3$-$^$7$?!#(B
$B$J$*!"B>$N(B Web $B%5!<%P$H$N@\B3$G$OH/@8$7$^$;$s$G$7$?!#(B
$B!t:G=i$K$3$N8=>]$,5/$3$C$?;~$K$O%"%?%C%/$+$H;W$$$^$7$?(B(^^;)$B!#(B

$B2H$N4D6-$O<!$NDL$j$G$9!#(B

	OS:		FreeBSD 4.3-stable
	$B@\B3J}<0(B:	ppp($B%U%l%C%D(B ISDN)
	$B%V%i%&%6(B:	ja-netscape-communicator-linux-4.76

$B$5$F!"$3$N8=>]$,@5>oF0:n$G$"$k$H$O7h$7$F8@$($J$$$H;W$$$^$9$,!"(B
$B2H$N%^%7%s$H@\B3@h$N%5!<%P$N$I$A$i$,0-$$$s$G$7$g$&$+!)(B
$B!t$I$&8+$F$b$&$A$N%^%7%s$,0-$$$H$O;W$($J$$$s$G$9$,!&!&!&(B(^^;)

---
$B1-:,909T(B: $B9-Eg9q:]3X1!Bg3X(B $B9)3XIt(B $BEE;R9)3X2J(B ($B5l>N(B $B9-EgEE5!Bg3X(B)
une@seiryu.es.hkg.ac.jp or harrier@seiryu.es.hkg.ac.jp
