Subject: Re: [PATCH 1/3] [RFC] TCP syncookies: slow down timer to mitigate spoofing attacks

From: Florian Westphal <[email-masked]>
Date: Fri, 16 Aug 2013 23:47:06 +0200

Jiri Bohac <[email-masked]> wrote:
> This patch slows down the timer used in syncookies from 1/60 Hz to 1/60/4 Hz
> so that at any moment only two differrent timer values can be accepted.
> As a result, 1 bit of sequence number entropy is gained.
> 
> This changes the maximum cookie age limit from 4 - 5 minutes to 4 - 8 minutes.

I think we should just cap at 2 minutes (i.e, accept 0 and 1 minute delta).

A cookie is not validated if the last syn overflow is more than 3
seconds in the past anyway.