On Wed, Nov 2, 2011 at 2:07 PM, coderman <[email protected]> wrote: >... > - cipher suite probing to find un-accelerated suites or more > computationally expensive suites supported by a target.
a nice write up here covering relative costs of some suites, and more discussion on computation DoS: http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html suites clearly make a big difference (but you knew that already, right?) regarding concurrent connections stress, use >= 8G of memory on injector and: # in /etc/security/limits.conf : * soft nofile 65535 * hard nofile 2097152 # ... and ulimit -Hn 2097152 before launching load # in /etc/sysctl.conf : net.core.somaxconn = 2097152 net.ipv4.tcp_fin_timeout = 5 # or less # ... and sysctl -p /etc/sysctl.conf if you're routing through conntrack or equivalent facilities (this will cut your capacity in half) you also need to adjust conntrack limits. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
