Re: Conditional Accept and Overlapped I/O Question

From: BELUCHIN (BELUCHIN_at_discussions.microsoft.com)
Date: 10/01/04 

Date: Fri, 1 Oct 2004 03:59:02 -0700

Thanks for your prompt reply.

In our system, it is imperative to hide the listening port on the server
from the client under certain circumstances. We will try to implement option
number 2 that you suggested, that is, to not use the completion ports for the
listening socket.

Even though we have many incoming connections, we are certain that the
connection requests will come in from the same thread on the client side. A
single thread on the server side with a blocking WSAAccept should be
sufficient to deal with the incoming connections.

I'll drop a quick note after the trial.

"Alun Jones [MSFT]" wrote:

> "BELUCHIN" <BELUCHIN@discussions.microsoft.com> wrote in message
> news:962B933E-CE94-42B2-A30F-65DB60718246@microsoft.com...
> > Any thoughts on how to achieve conditional accept on sockets handled
> through
> > completion ports?
>
> Two ways:
>
> 1. Don't do conditional accepts, and just close the socket after it's
> accepted, if you wish to reject the connection. This is how most other
> platforms work.
> 2. Don't do IOCP on the listening socket - have a thread that blocks on
> WSAAccept(); or use asynchronous notifications (WSAAsyncSelect), event
> notifications (WSAEventSelect) or regular select() to tell you when the
> listening socket is ready for you to accept() on it.
>
> The general advice is not to use WSAAccept with SO_CONDITIONAL_ACCEPT,
> because it prevents the normal processes that deal with denial-of-service
> attacks (SYN flooding). Windows is the only platform where you have the
> ability to reset the connection this way, so the clients you are dealing
> with should be comfortable with being connected, and then disconnected. You
> also have the chance to send a brief message explaining why the
> disconnection is being made, once you've accepted the connection.
>
> If your concern is to hide that you are listening on a port, that's what a
> firewall is for.
>
> Alun.
> ~~~~
>
>
>

Relevant Pages

  • Re: RealVNC
    ... I use VNC behind server ... Default listening port for RealVNC server that runs on the machine ... And then "other"party - not the client can run RealVNC Viewer in ...
    (microsoft.public.windows.server.sbs)
  • Re: interfaces lo:1 lo:2 lo:3? (for remote ssh tunnels)
    ... That's the problem tunneling (port forwarding) solves. ... >>can't get past the client firewall. ... > I don't understand why the server would be making the ... server initiates another connection to the client -- in this ...
    (Debian-User)
  • Re: RealVNC
    ... I use VNC behind server ... Then there is default Java listening port on port 5800 on the client ...
    (microsoft.public.windows.server.sbs)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: RealVNC
    ... I posted the identical content to both fora, which mentioned ISA 04. ... Default listening port for RealVNC server that runs on the machine on ... Then there is default Java listening port on port 5800 on the client ...
    (microsoft.public.windows.server.sbs)