Ignore resets of closing connections

Why it matters

After a TCP connection closes, the kernel keeps its record for a short while in a state called TIME-WAIT so stray packets are not mistaken for a new connection. A forged reset packet sent during that period can destroy the record early, which opens the door to confusion and hijacking. This is known as TIME-WAIT assassination.

How it works

Sets net.ipv4.tcp_rfc1337 to 1. Reset (RST) packets that arrive for a socket in the TIME-WAIT state are then dropped instead of ending that state early.

Who should use it

Fine for almost any computer. It departs slightly from strict TCP behavior in a way that RFC 1337 suggests, so a team with unusual network gear may want to test it first.

What you may notice

Nothing in everyday use.

Check it on your computer

Read the current value:

sysctl net.ipv4.tcp_rfc1337

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv4.tcp_rfc1337=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-tcp-rfc1337.conf <<'EOF'
net.ipv4.tcp_rfc1337 = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Survive connection floods
• Turn off selective acknowledgements

Sources

Linux Hardening Guide (madaidans)

2.2.2