Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 31 May 2001 14:00:43 -0500 (CDT)
From:      Mike Silbersack <silby@silby.com>
To:        Rob Simmons <rsimmons@wlcg.com>
Cc:        Liran Dahan <lirandb@netvision.net.il>, <freebsd-security@FreeBSD.ORG>
Subject:   Re: Limiting TCP RST Response Packets
Message-ID:  <20010531135800.F73746-100000@achilles.silby.com>
In-Reply-To: <Pine.BSF.4.21.0105311441450.4425-100000@mail.wlcg.com>

next in thread | previous in thread | raw e-mail | index | archive | help

On Thu, 31 May 2001, Rob Simmons wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> You will need to add the following line to your kernel config file, and
> recompile the kernel:
>
> options         TCP_RESTRICT_RST
>
> You should also read the comments about this option in the LINT file.

No.  Bad.  This is a paranoid response that will reduce the general
friendlyness of your box, and doesn't help much (if it all) more than
simply letting the built-in ratelimiting function.

However, if you wish to reduce the rst packets per second, tune the
net.inet.icmp.icmplim sysctl.  Don't reduce the count to zero, that means
unlimited.  I find 20 to be a nice limit, personally.

Mike "Silby" Silbersack


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010531135800.F73746-100000>