lkml.org 
[lkml]   [1998]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Firewalling and network resource consumption while under attack

    -----BEGIN PGP SIGNED MESSAGE-----

    On Mon, Sep 21, 1998 at 08:43:06AM -0700, david wrote:
    > Reply to mail from Alan Cox about Firewalling and network resource consumption while under attack
    > -----------------
    [snip]
    >
    > >> I haven't looked at the networking code, but the supposition is that the
    > >> firewall should drop the offending packets and not allow them to consume
    > >> my entire stack.
    > >
    > > No. The firewall can't magically tell who was a "good" connection, and
    > > if as I suspect you simply ran out of bandwidth you lose. The first rule
    > > of information and real warfare is the same "man with biggest club wins"
    >
    > If a firewall rule is in place to drop the packet on the floor, should
    > those packets still be allowed to consume the entire network stack?

    How do you propose telling what packets to drop *without* looking at them ?
    Frames must be reassembled and backloged while waiting for processing.

    > Shouldn't there be a bit reserved for the communications that are already
    > in place?
    >
    Tell that to the router that is feeding you the IP frames.
    With shaper and source routing you can do that for TCP connections. People
    can still pipe stuff down your link.

    [snip]

    > It sounds like the firewall is dropping the packets late in the game after
    > the packets have already done their damage. That being consuming
    > resources. Is this changeable?
    >
    It's like this ->
    assemble IP frame . look at source/numbering. match against firewall list.
    drop

    you want to drop the frames even before they are reassembled.

    - --
    Carlos Morgado - l39801@alfa.ist.utl.pt - http://alfa.ist.utl.pt/~c39801
    PGP Key fingerprint = 43 BF 53 98 EB 32 F5 17 9E EB 77 1F 57 8C C6 83

    -----BEGIN PGP SIGNATURE-----
    Version: 2.6.3i
    Charset: noconv

    iQCVAwUBNgaku4ewijNBLgpJAQEJKAQAie0lEDp7ArA3f8yXE6GOWm5KZBFdGgSI
    tTRRh1fhLyV3QkAmKSjQimVz28WOW2VBi0+fsj7csg+U2miVVJLEDB+ZVMMJ57Aq
    j0bu07XRVUHP89xSE6v6zjb3ONTE9yrTUHSmUhGyE2LGgd83Hk60TF9E5zp1kWdj
    66sGUMCMtcU=
    =5T27
    -----END PGP SIGNATURE-----

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:44    [W:3.818 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site