From owner-freebsd-ipfw Sat Aug 3 17:18: 4 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 68E5937B400 for ; Sat, 3 Aug 2002 17:18:02 -0700 (PDT) Received: from relay03.esat.net (relay03.esat.net [193.95.141.41]) by mx1.FreeBSD.org (Postfix) with ESMTP id C09F543E42 for ; Sat, 3 Aug 2002 17:18:01 -0700 (PDT) (envelope-from phil@ipac.ie) Received: from ipac-gw.cr001.ddm.esat.net (mail.rfc-networks.ie) [193.95.188.30] by relay03.esat.net with esmtp id 17b95p-0001Be-00; Sun, 04 Aug 2002 01:17:57 +0100 Received: from tear.domain (unknown [10.0.1.254]) by mail.rfc-networks.ie (Postfix) with ESMTP id C2DB054834 for ; Sun, 4 Aug 2002 00:21:55 +0100 (IST) Received: by tear.domain (Postfix, from userid 1000) id CC5E421146; Sun, 4 Aug 2002 01:19:00 +0000 (GMT) Date: Sun, 4 Aug 2002 01:19:00 +0000 From: Philip Reynolds To: freebsd-ipfw@freebsd.org Subject: Re: timeout Message-ID: <20020804011900.A1711@rfc-networks.ie> Reply-To: philip.reynolds@rfc-networks.ie References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: ; from eberkut@minithins.net on Sat, Aug 03, 2002 at 05:06:12PM +0200 X-Operating-System: FreeBSD 4.6-STABLE X-URL: http://www.rfc-networks.ie Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG eberkut 28 lines of wisdom included: > I can't comment on this obviously. > Also there is a type of timeout features which could be > useful both for security or state track tuning, those similar > to Cisco's CBAC global timeouts or the pf.conf's set timeout > options (see > http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secu > r_c/scprt3/scdcbac.htm#xtocid27 > and pf.conf(5) readable on openbsd.org). Specially, CBAC > does a great work against syn flood & co. Some options may > also be useful against scan. And one can use state timeout > to agressively drop unresponsive/congested/slow connections. > > just a few feature suggestions ;) Without reading the detailed description of CBAC, from what you mention there aren't, the sysctl variables: - net.inet.ip.fw.dyn_ack_lifetime - net.inet.ip.fw.dyn_syn_lifetime etc. etc. What you're looking for? -- Philip Reynolds | Technical Director philip.reynolds@rfc-networks.ie | RFC Networks Ltd. http://www.rfc-networks.ie | +353 (0)1 8832063 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message