Henning Brauer: tcp synfloods - BSDCan 2017

Henning Brauer explains the history of TCP SYN flood attacks and details improvements to the pf packet filter to mitigate them.

an old yet current problem, and improving pf's response TCP Synfloods have been with us for decades. Why are they still a problem? What countermeasures have been implemented in network stacks? How can we improve pf's synflood handling? I'm working on pf to detect synfloods and then cope better with them then we already do. I'll explain why this so old problem is still current and hasn't been solved. We'll then look at common countermeasures, their effectivity, and their downsides. And eventually, I'll detail the upcoming changes to pf improving synflood resiliency for pf itself and protection for the hosts behind. bsdcan.org/2017/schedule/events/816.en.html