Kaiser Permanente Medical GroupKaiser Permanente South San Francisco Medical Center 1200 El Camino Real, South San Francisco, CA 94080 (650)7422000 (phone), (650)7422606 (fax)
Dong Lin MD 950 Stockton St STE 207, San Francisco, CA 94108 (415)3999646 (phone), (415)3990156 (fax)
Education:
Medical School Beijing Med Univ, Beijing City, Beijing, China Graduated: 1982
Procedures:
Destruction of Benign/Premalignant Skin Lesions Hearing Evaluation Vaccine Administration
Dr. Lin graduated from the Beijing Med Univ, Beijing City, Beijing, China in 1982. He works in San Francisco, CA and 1 other location and specializes in Pediatrics. Dr. Lin is affiliated with California Pacific Medical Center California Campus, Kaiser Permanente Medical Center and UCSF Medical Center Parnassus.
A SYN packet bandwidth Distributed Denial-of-Service (DDoS) attack is defended against by intercepting and identifying SYN packets in a “DDoS gateway” advantageously positioned at the edge of the network to be protected (e. g. , one hop upstream from the protected link), and by queuing these intercepted SYN packets in a separate queue from other TCP packet queues. Edge per-flow queuing is employed to provide isolation among individual TCP connections sharing the link. A fair scheduling algorithm such as round robin scheduling is used to ensure that SYN packets (such as those generated as part of a SYN bandwidth attack) cannot overwhelm the egress link in the presence of other TCP packets.
Method And Apparatus For Defending Against Distributed Denial Of Service Attacks On Tcp Servers By Tcp Stateless Hogs
A Distributed Denial-of-Service (DDoS) attack by a TCP stateless hog is defeated with use of an enhancement to the keep-alive mechanism provided by RFC 1122. A TCP server receives a new TCP connection request from a possible attacker and sends a keep-alive probe packet back thereto using an “invalid” sequence number. Illustratively, this “invalid” sequence number comprises a random number selected to be reasonably distant from the actual current sequence number. When a responsive packet is received from the potential attacker, the TCP server verifies the accuracy of the acknowledgement number in the received packet, thereby determining whether the potential attacker may be a TCP stateless hog.