Date: Thu, 31 May 2001 14:00:43 -0500 (CDT) From: Mike Silbersack <silby@silby.com> To: Rob Simmons <rsimmons@wlcg.com> Cc: Liran Dahan <lirandb@netvision.net.il>, <freebsd-security@FreeBSD.ORG> Subject: Re: Limiting TCP RST Response Packets Message-ID: <20010531135800.F73746-100000@achilles.silby.com> In-Reply-To: <Pine.BSF.4.21.0105311441450.4425-100000@mail.wlcg.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 31 May 2001, Rob Simmons wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > You will need to add the following line to your kernel config file, and > recompile the kernel: > > options TCP_RESTRICT_RST > > You should also read the comments about this option in the LINT file. No. Bad. This is a paranoid response that will reduce the general friendlyness of your box, and doesn't help much (if it all) more than simply letting the built-in ratelimiting function. However, if you wish to reduce the rst packets per second, tune the net.inet.icmp.icmplim sysctl. Don't reduce the count to zero, that means unlimited. I find 20 to be a nice limit, personally. Mike "Silby" Silbersack To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010531135800.F73746-100000>