Subject: Re: Connection Establishment

From: "Jeremy Harris [RU-UK]" <[email-masked]>
Date: Wed, 13 Feb 2002 15:16:03 +0000 (GMT)

[David Nicol]
> fascinating -- you're suggesting HTTP over datagrams.  Or at least
> acting like datagrams when all you really want is a datagram.  You
> can dispense with the connection when all you want is a datagram.

Not quite...  I'm suggesting a use of TCP which degenerates to datagram
behaviour when it can, gives lower latency, client, net and server
resource usage when it can, and uses a full TCP connection when it
has to for the general case.

[Henk Langeveld]
>This is beginning to look like the DNS approach:  Just use udp
>on the first attempt, and revert to tcp when the result would be
>too large?

No, it's TCP all the way.

>Frankly, given that one of the conditions given was sufficient
>resistance/defence against DoS attacks,  I doubt this will ever
>escape the lab.  A proper defence against DoS attacks is miserly
>conduct with your resources, until you've established at least
>some validity in the request - this will require a round trip from
>server to client.

I agree about the proper defence.  But parsing an http GET and searching
a kernel URL cache isn't too expensive, and the eager action on it
simple to disable when the system load it high or a SYN attack detected.

>If you're going to allow initial datagrams carrying data, you'll
>have to limit the size of that data, possibly using the same
>constraints as the DNS udp/tcp switch referred to above.

Yes.

>You might
>be thinking of a specific application for this web-service, where
>you'd control the network stack of both client and server *and*
>the network in between.  Then you've got your value-add network,
>with your own application protocol - why use http?

No, I'd like to see it in general use.

[Bob Braden]
>  *> arises: how much data may be piggybacked on a SYN?  What window may
>  *> the sender assume?
>  *>
>
>Please see RFC 1644 on T/TCP (July 1994)/

I did. It suggests using the window specified by a previous connection.
Which is fine if you had one.

Cheers,
   Jeremy

---

From: Henk Langeveld - NL <[email-masked]>
Date: Wed, 13 Feb 2002 16:49:58 +0100

> simple to disable when the system load it high or a SYN attack detected.

How do you detect a SYN attack?

Henk

---

From: Alan Cox <[email-masked]>
Date: Wed, 13 Feb 2002 17:19:12 +0000 (GMT)

> Which is fine if you had one.

And completely unsafe nowdays with proxies stealing some ports, port 
specific routing and the like. The later TCP rfcs made a convincing case 
including good studies that the initial congestion window should be two
frames. That would I suspect mean that 2*mss was a reasonable way to open
fire. 

Alan