TCP acknowledgement question 4

[Zmilos]

Hi,

please excuse my poor English.
I need help with the frequency of acknowledgement in TCP.

Does receiver always send one acknowledgement per received
segment or if more segments arrive in the same time the
receiver could send only one acknowledgement for all of them?
I'm currently using books such as TCP/IP guide,
TCP/IP Internetworking Comer etc., but I can't see this one.

Thank you for your time
and once again forgive my English

 

[LawnBoy]

The reciever cannot send an ACK that refers to more than one packet.

Here's a couple of good links:

http://courses.cs.vt.edu/~cs5516/spring03/slides/tcp1_1.pdf

http://www.novell.com/connectionmagazine/2000/03/hand30.pdf

"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes

 

[burtsbees]

Sender sends a TCP-SYN packet, receiver sends SYN-ACK, sender sends TCP-ACK back to receiver, to acknowledge the SYN-ACK was received. DoS (Denial of Service) Attacks utilize this TCP technology by sending thousands of TCP-SYN packets from multiple different IP addresses (usually), and the server has to try and free up resources for each connection, and answer each SYN packet with a SYN-ACK. This can easily bring the server to its knees. One way to easily thwart this attack is TCP Intercept.
With TCP Intercept, the router that is configured with TCP Intercept will proxy-answer the SYN requests with a SYN-ACK of its own, and does not imediately pass the SYN packet to the server. If the requesting node answers the router with an ACK, then the packet is thought to be genuine, and therefor handed off to the intended server. If the sending node never answers the SYN-ACK that the router proxy-sends, then the TCP session is dropped, and the server never even sees it. The sessions can also be monitored instead of immediately dropped, so that you can log where the attack seems to be coming from.

Burt

 

[burtsbees]

This is what I was commenting on...

"The reciever cannot send an ACK that refers to more than one packet."

With DoS SYN-flood attacks, this is how thy work, actually, by the receiver (target) SYN-ACK'ing multiple packets from multiple spoofed IP addresses.

Burt