Subject: Re: DSCP values in TCP handshake

From: Stephen Hemminger <[email-masked]>
Date: Mon, 18 Apr 2011 21:16:37 -0700

On Tue, 19 Apr 2011 05:50:34 +0200 (CEST)
Mikael Abrahamsson <[email-masked]> wrote:

> On Mon, 18 Apr 2011, Stephen Hemminger wrote:
> 
> > If the DSCP bits are reflected, then it could allow for even better SYN 
> > flood attack. Attacker could maliciously set DSCP to elevate priority 
> > processing of his bogus SYN packets and also cause SYN-ACK on reverse 
> > path to also take priority.
> 
> Incoming, it's already too late. Outgoing, yes, that might be a problem, 
> but if you have a QoS enabled network then you might as well solve that in 
> the network, not in the host.
> 
> Does Linux internally look at DSCP when deciding what SYNs to handle 
> first? If not, I think the above reasoning is misdirected.

Linux does not look at DSCP of incoming packets (there is no queue).

Of course, you can do anything with qdisc, and iptables.