CODEWITHSUNDEEP
c++linuxtcp
Josh Brittain
Josh Brittain

Reputation: 2212

C++ - Detecting multiple connections to server

In a Linux/C++ TCP server I need to prevent a malicious client from opening multiple sockets, otherwise they could just open thousands of connections until the server crashes.

What is the standard way for checking if the same computer already has a connection on the server? If I do it based off of IP address wouldn't that mean two people in the same house couldn't connect to the server at the same time even if they are on different computers?

Any info helps! Thanks in advance.

Upvotes: 0

Views: 188

Answers (2)

Mats Petersson
Mats Petersson

Reputation: 129374

There is only IP address to base "is this the same sender", unless you have some sort of subscription/login system (but then someone can try to log in a gazillion times at once, since there must be some sort of handshake for logging in).

If two clients are using the same router (that uses NAT or some similar scheme), your server will see the same IP address, so allowing only one connection per IP address wouldn't work very well for "multiple users from the same home". This also applies if they are for example using a university network or a company network.

So depending on what you are supplying and how many clients you can expect from the same place, you may need to go a fair bit higher than 10. Of course, if you log when this happens, and you see a fair number of "looks like valid real users failing to get in", you can adjust the number.

It may also make sense to have some sort of "rolling average", so you accept X new connections per Y seconds from each IP address, rather than having a fixed maximum number. This is meaningful if connections last quite some time... For short duration connections, it's pretty pointless...

Upvotes: 1

Jonathon Reinhart
Jonathon Reinhart

Reputation: 137398

TCP in itself doesn't really provide anything other than the IP address for identifying clients. A couple of (non-exclusive) options:

1) Limit the number of connections from any IP address to a reasonable number, like 10 or 20 (depending on what your system actually does.) This way, it will prevent malicious DoS attacks, but still allow for reasonable usability.

2) Limit the maximum number of connections to something reasonable.

3) You could delegate this to a higher-layer solution. As a part of your protocol, have the client send a unique identifier that is generated only once (per installation, etc). This could be easily spoofed, however.

I believe 1 and 2 is how many servers handle it. Put them in config files, so they can be tuned depending on the scenario.

Upvotes: 1

Related Questions