On Fri, Mar 23, 2007 at 09:17:19AM +0100, Eric Dumazet ([EMAIL PROTECTED]) wrote: > You have a machine somewhere that allows 65536 concurrent connections > coming from the same IP address ?
Attached png file of botnet scenario:
1000 addresses from the same network (class B for example),
each one creates 1024 connections to the same static port.
Eric, I agree, that XOR hash is not perfect, and it should be changed,
but not blindly.
I perfectly know that hash function is not bijective, but it must have
good distribution.
Function like this
int hash(u32 saddr, u16 sport, u32 daddr, u16 dport, u32 rand)
{
return ((((rand ^ saddr ^ daddr)>>16)^(dport ^ sport)) >>8);
}
has even worse _distribution_, although you can not predict its end
result due to random value, and attacker will not try to do it.
--
Evgeniy Polyakov
jhash_botnet.png
Description: PNG image
