On Wed, Dec 11, 2002 at 12:17:00PM -0800, Phil Dibowitz wrote: > Has anyone actually _had_ their state table DOS'd?
Dunno.
> I know I've seen rulesets on this list for massively huge unimaginably
> big sites which use keepstate... one of which was a university with a
> ruleset a hundreds and hundreds of lines...
>
> So I figure it's not much of a problem.
You're probably right; I just figured I'd mention it for the benefit of
the original poster. :|. I still see it as a fairly real angle of
attack if someone is aware of the use of stateful rules w/ ipf.
(Conditions may be similar w/ use of other packages -- I don't know how
they react to full state tables.)
I understand that the topic of exhausting a state table isn't new.
However, what I thought was worth noting was the ">= 30 second idle
crunch" present in 4.0a26. I made the mistake of assuming ipf's
behavior was like this even in 3.4.x.
::shrug::
--
ryan beasley <[EMAIL PROTECTED]>
GPG ID: 0x16EFBD48 http://www.goddamnbastard.org
msg01907/pgp00000.pgp
Description: PGP signature
