Re: DOS against SuSE's identd

[alan () MANAWATU GEN NZ (Alan Brown)]

On Sat, 14 Aug 1999, Hendrik Scholz wrote:

> The inetd.conf starts the identd with the options -w -t120
> -e.
> This means that one identd process waits 120 seconds after
> answering the first request to answer later request.

No, it means that the identd is persistent and will shut down after 120
seconds of idle time.

What ends up happening is that a master identd process spawns a child
for each request and you're running into a basic FD-based DoS attack.

AB