Re: Limiting TCP RST Response Packets

From: Rob Simmons (rsimmons@wlcg.com)
Date: 05/31/01 

Date: Thu, 31 May 2001 15:15:26 -0400 (EDT)
From: Rob Simmons <rsimmons@wlcg.com>
To: Mike Silbersack <silby@silby.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Maybe that should be mentioned in LINT?

Robert Simmons
Systems Administrator
http://www.wlcg.com/

On Thu, 31 May 2001, Mike Silbersack wrote:

>
> On Thu, 31 May 2001, Rob Simmons wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: RIPEMD160
> >
> > You will need to add the following line to your kernel config file, and
> > recompile the kernel:
> >
> > options TCP_RESTRICT_RST
> >
> > You should also read the comments about this option in the LINT file.
>
> No. Bad. This is a paranoid response that will reduce the general
> friendlyness of your box, and doesn't help much (if it all) more than
> simply letting the built-in ratelimiting function.
>
> However, if you wish to reduce the rst packets per second, tune the
> net.inet.icmp.icmplim sysctl. Don't reduce the count to zero, that means
> unlimited. I find 20 to be a nice limit, personally.
>
> Mike "Silby" Silbersack
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.5 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7FphSv8Bofna59hYRAyTvAJ979VdkOCleyOBmXGN1avmhm+B3igCfZsXb
GgT+DR70aWE6BPs5XufqAcM=
=u7r3
-----END PGP SIGNATURE-----

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message