Re: Syncookie firewall

[Don Cohen]

 > From: Henrik Nordstrom <[EMAIL PROTECTED]>
 > In my opinion, If you do "syncookie" in a firewall then the TCP should be 
 > terminated there, with another TCP in to the real server. I.e. a proxy 
 > solution.
Why do you think that's better than simply forwarding packets with
sequence/ack# translation?  Surely it's less efficient.  And it raises
questions about how much data to buffer between the two and how that
can be controlled.