Date: Tue, 18 Jan 2000 23:21:47 -0700 From: Wes Peters <wes@softweyr.com> To: patl@phoenix.volant.org Cc: David Wolfskill <dhw@whistle.com>, matt@ARPA.MAIL.NET, freebsd-security@freebsd.org Subject: Re: TCP/IP Message-ID: <388557FB.443E66B0@softweyr.com> References: <ML-3.4.948228615.4905.patl@asimov.phoenix.volant.org>
next in thread | previous in thread | raw e-mail | index | archive | help
patl@phoenix.volant.org wrote:
>
> On 18-Jan-00 at 11:21, David Wolfskill (dhw@whistle.com) wrote:
> > >Date: Tue, 18 Jan 2000 12:53:12 -0500
> > >From: matt <matt@ARPA.MAIL.NET>
> >
> > >I would love to talk my uplink (uunet.ca) into filtering certain things
> > >before they pass it on to my router, wish they would =/ Besides that, I
> > >filter syn,fin, icmp, all udp except ntp/dns, besides that, I don't think
> > >there is much that I can do.
> >
> > Put another router in series with it. Use an RFC 1918 "private net"
> > numbering scheme for that (pathological) network, which then becomes an
> > effective "demarc" between uunet.ca's responsibility/ability and yours.
> >
> > This generalizes, within reason. (Yes, it adds latency, too....)
>
> Umm, I think Matt's point was that he would like to filter these
> things out -before- they consume bandwidth between his uplink and
> his router. (I know I would...)
Get a better ISP. They should provide such services, and the good ones will.
They may charge to set it up, but they aren't going to want SYN floods on
their networks. If the flood is coming from within your ISP, talk to the ISP
and get the plug pulled on the flood source.
--
"Where am I, and what am I doing in this handbasket?"
Wes Peters Softweyr LLC
wes@softweyr.com http://softweyr.com/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?388557FB.443E66B0>