-- Forwarded message from Florian Weimer <fw@xxxxxxxxxxxxx> -- Please read the following paper: <http://www.cs.rice.edu/~scrosby/tr/HashAttack.pdf> Then look at the 2.4 route cache implementation. S
I dont think the author has done any testing actually at the rate they claim to have to - if they did they wouldnt be wording it as "carefully chosen source addresses". Yes it is - but not using the
Why don't you ask the author the wording is unclear? Have you actually read the paper? Do you understand its implications for the dst cache? Currently, the dst cache (which is a misnomer, as it inclu
I meant whoever said that 400pps would cause a DOS. I didnt see the dst cache test being described in the source, so i assume it is someone else other than people who wrote the tool. I skimmed throug
Ah, I see. I'm sorry for the confusion. Good! 8-) I don't think so. During a DoS attack with spoofed source addresses, the dst cache quickly fills up, and the overwhelming majority of the entries is
Do: cat /proc/net/rt_cache_stat Should give us a lot more info. Yes, in that (worse case) scenario, you have two effects one of walking a lot of elements before finding you have a cache miss and then
You can use rtstat to read it. robur.slu.se: /pub/Linux/net-development/rt_cache_stat/rtstat.c It's in iproute2 package too but it seems to be an older version. Cheers. -ro