tcp storm attack

wulinweng — Fri, 22 Jan 2016 09:34:02 GMT

Dear Support:

Now we used mqx4.1 with TCP/IP stack, and we encoutered a problem is that we use a tool to send some tcp packets to our device through the certain port like 80, and the device's normal tcp connection function will be unnormal, like the web server port 80 will not ok, after the tool stop sending the storm packets 2 minutes. the web server function will recover again.

What I want to know is that is it normal or we should do some change in the mqx tcp/ip source code to deal with the network storm attack?

BR,

Re: tcp storm attack

danielchen — Fri, 29 Jan 2016 04:09:54 GMT

Hi wulin

I think it is normal behavior. When you send lots of packets to your device, the RTCS stack need time to process the incoming packets.

There is a parameter in RTCS stack to define the number of packets you want to RTCS to handle at any given time. RTCSPCB. The default value is 4 in some system. If you send more than 4 packets at one given time, the new packets will be lost. Since MCU is a memory limited system, at most time we can’t increase this value to a large value.

There is a document about the RTCS memory configurations

https://community.freescale.com/docs/DOC-102077

Regards

Daniel

topic Re: tcp storm attack in MQX Software Solutions

tcp storm attack

Re: tcp storm attack