Date: Fri, 23 Feb 2001 10:39:00 +0000 From: simond@irrelevant.org To: Alex Hayward <xelah@xelah.com> Cc: freebsd-stable@FreeBSD.ORG Subject: Re: ipfw drop syn+fin Message-ID: <20010223103859.D37155@irrelevant.org> In-Reply-To: <Pine.LNX.4.10.10102231024230.15158-100000@sphinx.mythic-beasts.com>; from xelah@xelah.com on Fri, Feb 23, 2001 at 10:34:57AM %2B0000 References: <Pine.BSF.4.05.10102220849460.28368-100000@shell.uniserve.ca> <Pine.LNX.4.10.10102231024230.15158-100000@sphinx.mythic-beasts.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Feb 23, 2001 at 10:34:57AM +0000, Alex Hayward wrote: > On Thu, 22 Feb 2001, Tom wrote: > > > On Thu, 22 Feb 2001, Alexandr Kovalenko wrote: > > > > > # TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This > > > # prevents nmap et al. from identifying the TCP/IP stack, but breaks support > > > # for RFC1644 extensions and is not recommended for web servers. > > > > > > I'm wondering _why_ it is not recommended for web servers? > > > > Because RFC1644 extensions are valuable for web servers, and client > > clients use them when making web requests. So guess what happens when > > your server drops requests using RFC1644 extensions? > > Since what it does is cut the connection open/close time (well, it > shortens the TIME_WAIT time, too, but I doubt that's so important...) from > 7 packets to 3 it's not quite so important in these days of persistent > HTTP connections. Oh, and it can't be used for the first connection a > client makes since the server needs to cache a connection count from each > client which is passed in a TCP option. Both server and client need to be > written in a particular way to take advantage of it, too. > > Oh, and nothing that I've found supports it apart from FreeBSD; which has > it turned off by default. I'd be interested to know if anyone knows any > different... I know this isn't really a major platform, but the Miami TCP stack on the Amiga supports it, along with at least one of the browsers which runs on the Amiga :) -- Simon Dick simond@irrelevant.org "Why do I get this urge to go bowling everytime I see Tux?" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010223103859.D37155>