Re: Limiting TCP RST Response Packets

From: Mike Silbersack (silby@silby.com)
Date: 05/31/01 

Date: Thu, 31 May 2001 14:00:43 -0500 (CDT)
From: Mike Silbersack <silby@silby.com>
To: Rob Simmons <rsimmons@wlcg.com>

On Thu, 31 May 2001, Rob Simmons wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> You will need to add the following line to your kernel config file, and
> recompile the kernel:
>
> options TCP_RESTRICT_RST
>
> You should also read the comments about this option in the LINT file.

No. Bad. This is a paranoid response that will reduce the general
friendlyness of your box, and doesn't help much (if it all) more than
simply letting the built-in ratelimiting function.

However, if you wish to reduce the rst packets per second, tune the
net.inet.icmp.icmplim sysctl. Don't reduce the count to zero, that means
unlimited. I find 20 to be a nice limit, personally.

Mike "Silby" Silbersack

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message