Darren Reed wrote: > ftpd's which limit connections to 1 per user@host or similar may have some > defense against this, or if they don't support multiple data connections > open at the same time. FTP does NOT support multiple data channels. The standard says that the server MUST close the previous connection if the user agent initiates a new channel (by using PORT/PASV). All FTP servers I have tried does this. This attack is a TCP FIN_WAIT2 attack. I.e. it is more of an TCP DOS than an FTP DOS. Any TCP service which accepts unlimited rate of connections can be attacked in this way if you can affort (or spoof) to have that number of TCP connection open. The main difference from other FIN_WAIT2 attacks is that the FTP service usually does not log each individual data channel connection, making it hard to locate once the attacker has closed down the attack. -- Henrik Nordstrom
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:19:07 PDT