java socket：在接受之前听？ [英] java socket: listen before accept?

问题描述

上下文：由于DOS攻击，我在我的程序内存中的某个集合中有一张禁止ip地址表。

我使用TCP服务器套接字，接受每个连接，然后我检查IP地址，然后我关闭连接或继续处理客户端。

我想知道它是否是在Java中，可以监听TCP服务器套接字上的连接，并在给定请求客户端的IP地址的情况下以某种方式接受或拒绝建立tcp链接。我的意思是不必接受&关闭客户端套接字，这就是我现在正在做的事情。

谢谢。

解决方案

不使用 SecurityManager ，您只能接受，然后检查传入的IP地址，并删除连接（如果它在禁止列表中）。使用 SecurityManager ，您可以让它抛出 SecurityException ，并给它特殊处理（例如在应用程序的安全日志中记录连接请求）。 / p>

如果你不希望这些连接甚至命中你的服务器（我猜这是重点），你真的想在防火墙级别阻止它。一旦连接到达您的应用程序，它已经占用了与您的应用程序通信所需的内存和资源，所以此时您已经丢失了DOS / DDOS游戏。

在接受之前或之后删除它并不重要，因为连接已经达到应用程序的应用程序级别。即使使用 SecurityManager ，它仍在增加服务器的负载。

The context: I have a table of banned ip adresses, due to DOS attacks, in a collection somewhere in the memory of my program.

I use a TCP server socket, accepting every connection, then I check the ip address, and then I either close the connection or continue processing the client.

I'd like to know if it's possible, in Java, to listen for incomming connections on a TCP server socket, and accept or refuse somehow to establish the tcp link, given the ip address of the requesting client. I mean without having to accept & to close the client socket, which is what I'm already doing.

Thanks.

解决方案

Without using a SecurityManager, you can only accept, then check the incoming IP address, and drop the connection if it's on the banned list. With a SecurityManager, you can have it throw a SecurityException, and give it special handling (such as logging the connection request in a security log in the app).

If you don't want these connections to even hit your server (which I'm guessing is the point), you really want to block it at the firewall level. Once the connection hits your app, it's already taken up the memory and resources necessary to talk to your application, so at that point you've already lost the DOS/DDOS game.

Dropping it before or after an accept doesn't matter, because the connection has already hit the application level of your app. Even with a SecurityManager, it's still increasing the load on your server.

这篇关于java socket：在接受之前听？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！