Re: [Full-disclosure] THC SSL DOS tool released

[coderman <coderman@xxxxxxxxx>]

On Wed, Nov 2, 2011 at 2:07 PM, coderman <coderman@xxxxxxxxx> wrote:
>...
> - cipher suite probing to find un-accelerated suites or more
> computationally expensive suites supported by a target.

a nice write up here covering relative costs of some suites, and more
discussion on computation DoS:
  http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html

suites clearly make a big difference (but you knew that already, right?)


regarding concurrent connections stress, use >= 8G of memory on injector and:

# in /etc/security/limits.conf :
*               soft    nofile          65535
*               hard    nofile         2097152
# ... and ulimit -Hn 2097152 before launching load

# in /etc/sysctl.conf :
net.core.somaxconn = 2097152
net.ipv4.tcp_fin_timeout = 5 # or less
# ... and sysctl -p /etc/sysctl.conf

if you're routing through conntrack or equivalent facilities (this
will cut your capacity in half) you also need to adjust conntrack
limits.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/