This paper proposes a way which combines TCP Proxy with the ACK waiting queue to filter DDoS TCP Flooding attacks,and implements it within the Linux kernel.

• 该文提出了一种TCPProxy与待响应ack队列相结合的、能够对TCP绝拒服务攻击进行有效过滤的方法,并用这种方法在Linux内核中实现了一个高速过滤器。