TCP Cookie Transactions

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Bender235 (talk | contribs) at 22:37, 21 July 2016 (clean up; http->https (see this RfC) using AWB). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

TCP Cookie Transactions (TCPCT) is specified in RFC 6013 (experimental status) as an extension of Transmission Control Protocol (TCP) intended to secure it against denial-of-service attacks, such as resource exhaustion by SYN flooding and malicious connection termination by third parties.[1] Unlike the original SYN cookies approach,[2] TCPCT does not conflict with other TCP extensions, but requires TCPCT support in the client (initiator) as well as the server (responder) TCP stack.[3]

The immediate reason for the TCPCT extension is deployment of the DNSSEC protocol. Prior to DNSSEC, DNS requests primarily used short UDP packets, but due to the size of DNSSEC exchanges, and shortcomings of IP fragmentation, UDP is less practical for DNSSEC.[4][5] Thus DNSSEC-enabled requests create a large number of short-lived TCP connections.[3][6]

TCPCT avoids resource exhaustion on server-side by not allocating any resources until the completion of the three-way handshake. Additionally, TCPCT allows the server to release memory immediately after the connection closes, while it persists in the TIME-WAIT state.[3]

TCPCT support was partly merged into the Linux kernel in December 2009,[7][8] but was removed in May 2013 because it was never fully implemented and had a performance cost.[9]

See also

References

  1. ^ Simpson, W. (2011). TCP Cookie Transactions. IETF. doi:10.17487/RFC6013. RFC 6013. Retrieved March 16, 2012. {{citation}}: Unknown parameter |month= ignored (help)
  2. ^ Daniel J. Bernstein. "SYN cookies". SYN cookies "do not allow to use TCP extensions" such as large windows. [...] A connection saved by SYN cookies can't use large windows
  3. ^ a b c Perry E. Metzger, William Allen Simpson, Paul Vixie (December 2009). "Improving TCP Security With Robust Cookies" (PDF). {{cite journal}}: Cite journal requires |journal= (help)CS1 maint: multiple names: authors list (link)
  4. ^ B. Carpenter and S. Brim, “Middleboxes: Taxonomy and Issues,” RFC 3234, February 2002.
  5. ^ P. Srisuresh and K. Egevang, “Traditional IP Network Address Translator (Traditional NAT),” RFC 3022, January 2001
  6. ^ D. Wessels (June 2009). "DNSSEC, EDNS, and TCP" (PDF). DNS-OARC. {{cite journal}}: Cite journal requires |journal= (help)
  7. ^ Jake Edge (16 December 2009). "TCP cookie transactions". LWN.net.
  8. ^ http://kernelnewbies.org/Linux_2_6_33#head-2c3c3a8cb87d5b7a6f1182e418abf071cda22c8c
  9. ^ Jonathan Corbet (8 May 2013). "What's coming in 3.10, part 2". LWN.net.


Stub icon

This computer networking article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=TCP_Cookie_Transactions&oldid=730953302"