Machine LatencyMethods for increasing end-node processing

• Fake entire three way handshake

• Fake connections to well known sniffed ports

• Use “legitimate” ether addresses that still have no physical presence

• Fake huge numbers of sessions

• Fake huge numbers of SYN recv’d states

The trick is to make the sniffing application

process as much as possible in user space

Previous slide

Next slide

Back to first slide

View graphic version