I believe dropping is also preferable if you need more performance and bandwidth capacity although I'm not sure sending RST cost CPU time on ASA platform.
On Apr 4, 2008, at 7:18 PM, <[EMAIL PROTECTED]> <[EMAIL PROTECTED] > wrote: >> I'd tend to think that it's less about portscans and more >> about preventing >> someone using you to perform a bounced RST flood. Just my 0x2. > > That's a good argument, but you can use your regular rate limiters > (which are in place for icmp for example) and anomaly detection for > that. Or whatever antispoofing you might have in place -- Yaroslav Doroshenko _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
