z/VM: TCP/IP User's Guide - z/VM - IBM

Summary of Changes
This section describes the technical changes made in this edition of the book and in
previous editions. For your convenience, the changes made in this edition are
identified in the text by a vertical bar (|) in the left margin. This edition may also
include minor corrections and editorial changes that are not identified.
Second Edition for z/VM Version 4 (May 2002)
This edition contains updates for the General Availability of TCP/IP Level 430.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
PASV FTP client support
A new FTP PASSIVE subcommand has been added so that z/VM FTP clients
outside of a firewall can transfer files to and from an FTP server that is inside of a
firewall.
TCP/IP Stack Vulnerability Reduction
Function has been added to improve the performance and reliability of the TCP/IP
stack by preventing more Denial-of-Service (DoS) attacks. These attacks include:
v
v
v
v
v
v
Kiss-of-Death (KOD) — an IGMP based attack that depletes the stack’s large
envelopes
KOX — a version of the KOD attack that also has source IP address spoofing
Stream — an attack in which TCP packets are sent to the stack with no header
flags set
R4P3D — an augmented version of the Stream attack
Blat — a version of the Land attack that also has the URG flag turned on in the
TCP header and has the ability to incrementally spoof the source IP address
SynFlood — an attack in which the initiator floods the TCP/IP stack with SYN
packets that have spoofed source IP addresses, resulting in the server never
receiving the final ACKs needed to complete the three-way handshake in the
connection process.
The Smurf DoS attack has also been updated to address three variants of the
attack. Smurf is a DoS attack in which an ICMP Echo Request is sent to a
broadcast or multicast address. The three variants are:
v
v
v
Smurf-IC — where ″IC″ denotes that incoming packets are using the TCP/IP
stack to launch an attack
Smurf-OB — where ″OB″ denotes that an outbound ICMP Echo Request
matched the description of a Smurf attack
Smurf-RP — where ″RP″ denotes that ICMP Echo Reply packets being received
by the stack do not match any Echo Requests that were sent.
First Edition for z/VM Version 4 (October 2001)
This edition contains updates for the General Availability of TCP/IP Level 420.
TCP/IP Stack Performance and Reliability Improvements
Function has been added to improve the performance and reliability of the TCP/IP
stack by preventing some Denial of Service (DOS) attacks. These attacks include:
© Copyright IBM Corp. 1987, 2002 xiii