I'd tend to think that it's less about portscans and more about preventing
someone using you to perform a bounced RST flood. Just my 0x2.
--
robbie
<nick.nauwelaerts
@thomson.com>
Sent by: To
cisco-nsp-bounces <[email protected]>
@puck.nether.net cc
Subject
04/04/2008 09:55 Re: [c-nsp] OT: Check Point v Cisco
AM PIX (ASA 5500 Series)
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Friday, April 04, 2008 16:42
> To: Javier Liendo
> Cc: Nauwelaerts, Nick (TCM); [email protected]
> Subject: Re: [c-nsp] OT: Check Point v Cisco PIX (ASA 5500 Series)
>
> Hi,
>
> > for a firewall, not sending an RST for a denied connection, isn´t it
> > the "Right Thing" to do?
>
> ah, the perennial DROP or REJECT question.
Yup, I'm for rejecting. It's what applications expect and I still have not
heared any convincing arguments as to why I would want to drop instead. It
seems dropping increases your security in some magical way, but for a well
done portscan dropping isn't even an extra hurdle. All dropping does is
make troubleshooting a pain.
// nick
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
