ryan beasley wrote:
Disadvantage:Has anyone actually _had_ their state table DOS'd?
May lead to a particularly nasty situation in the cases of either heavy
load or DoS.
While this is probably common sense to the lot of you, it may be useful to
the original poster.
IP Filter has a finite amount of space defined at compile time to use for
state entries. If this limit is reached, either from heavy loads or
malice, IP Filter begins cycling through idle state entries, freeing them
as new entries are needed. Initially starting with entries idle for more
than 4 days, extreme circumstances may lead it to reclaim entries idle for
no less than 30 seconds.
This can be particularly ugly if your login (or any other) services are
governed by state rules:
e.g., pass in quick proto tcp from <trusted> to <fw> port = 22 flags S
keep state
I know I've seen rulesets on this list for massively huge unimaginably big sites which use keepstate... one of which was a university with a ruleset a hundreds and hundreds of lines...
So I figure it's not much of a problem.
--
Phil Dibowitz [EMAIL PROTECTED]
Freeware and Technical Pages Insanity Palace of Metallica
http://home.earthlink.net/~jaymzh666/ http://www.ipom.com/
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
- Benjamin Franklin, 1759
