Re: iptables / reject vs drop

From: Andrew Schulman (andrex_at_deadspam.com)
Date: 10/27/04 

Date: Wed, 27 Oct 2004 13:42:21 -0400

> It is usually a good idea to send back TCP RST packets for the AUTH port.
> Not doing so will slow down mail transfers from sites that check to see
> if an ident server is running. Instead of failing immediately, the connection
> attempt will need to timeout.

Also, many IRC servers query AUTH and will wait forever for a response
if they don't at least get a RST back, effectively denying your
connection.

> The security advantage of not sending back TCP RST packets is pretty low.
> It isn't worth screwing up any of your services by not sending them.

Probably true. 

-- 
To reply by email, change "deadspam.com" to "alumni.utexas.net"

Relevant Pages

  • Re: iptables / reject vs drop
    ... Bruno Wolff III writes: ... > It is usually a good idea to send back TCP RST packets for the AUTH port. ...
    (comp.os.linux.security)
  • Re: problems caused by net.inet.tcp.blackhole=2
    ... > the another machine with persistant local problems (smbclient). ... sending of TCP RST packets which are needed to tear down dead ... connections, and if one end of the connection thinks the connection is ... the hosts that reuses the same addresses and ports as the old ...
    (freebsd-net)