From owner-freebsd-current Thu Feb 29 10:00:26 1996 Return-Path: owner-current Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id KAA26112 for current-outgoing; Thu, 29 Feb 1996 10:00:26 -0800 (PST) Received: from who.cdrom.com (who.cdrom.com [192.216.222.3]) by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id KAA26107 for ; Thu, 29 Feb 1996 10:00:23 -0800 (PST) Received: from rover.village.org (rover.village.org [204.144.255.49]) by who.cdrom.com (8.6.12/8.6.11) with ESMTP id KAA00882 for ; Fri, 1 Mar 1996 10:00:15 -0800 Received: from localhost (localhost [127.0.0.1]) by rover.village.org (8.6.11/8.6.6) with SMTP id KAA03050; Thu, 29 Feb 1996 10:57:55 -0700 Message-Id: <199602291757.KAA03050@rover.village.org> To: Paul Traina Subject: Re: Processing ICMP packets (was: -stable hangs at boot (fwd)) Cc: Andras Olah , current@freebsd.org In-reply-to: Your message of Thu, 29 Feb 1996 09:04:21 PST Date: Thu, 29 Feb 1996 10:57:55 -0700 From: Warner Losh Sender: owner-current@freebsd.org Precedence: bulk : It does have special meaning. Theoretically, you SHOULD be able to say : "if I get 9 (or 10) I cannot reach that net (or host), period." However, : many firewalls generate 9 or 10 (which was obsoleted by 13 for just this : reason). 13 says "don't assume anything other than this connection attempt : was refused for administrative reasons." Just so long as you don't wind up triggering the old 4.2 TCP bug. Namely, when a port is unreachible, then *ALL* connections to that host are discarded. It is safer to silently discard packets in a packet filter than to send back ICMP messages since it won't trigger these bugs and will be treateed as if it was lost and retransmitted or timed out. If people feel strongly that they want it, then it should be an option that can be turned off since we have to deal with said 4.2 TCP implementations from time to time and an accidental connection could cause us great grief. If someone has the old TCP code from then, and can assure me that this won't be a problem because it doesn't understand type 13 packets, then never mind. Warner