Re: tcp_syncookie question

2011-06-02 Thread Bill Davidsen
Genes MailLists wrote: > On 06/01/2011 02:20 PM, Bill Davidsen wrote: > as squeezed out if I remember right to make room > >>> for the cookie) ... >>> >>> and therefore some performance degradation when the machine gets busy >>> ... so its never been totally problem free in that sense ... >

Re: tcp_syncookie question

2011-06-01 Thread Genes MailLists
On 06/01/2011 02:20 PM, Bill Davidsen wrote: as squeezed out if I remember right to make room >> for the cookie) ... >> >>and therefore some performance degradation when the machine gets busy >> ... so its never been totally problem free in that sense ... >> >> > Depending on what you do, more

Re: tcp_syncookie question

2011-06-01 Thread Bill Davidsen
Genes MailLists wrote: > On 06/01/2011 12:57 PM, Bruno Wolff III wrote: >> On Wed, Jun 01, 2011 at 11:09:35 -0400, >> >> Unless there is some other alternate way to maintain state in the packets, >> the DoS attacks will still work. If you aren't worried about those you >> could turn it off. >> >> A

Re: tcp_syncookie question

2011-06-01 Thread Genes MailLists
On 06/01/2011 12:57 PM, Bruno Wolff III wrote: > On Wed, Jun 01, 2011 at 11:09:35 -0400, > > Unless there is some other alternate way to maintain state in the packets, > the DoS attacks will still work. If you aren't worried about those you > could turn it off. > > Also, my memory is that there i

Re: tcp_syncookie question

2011-06-01 Thread Bruno Wolff III
On Wed, Jun 01, 2011 at 11:09:35 -0400, Genes MailLists wrote: > > Right - I understand its purpose and benefits - but networking (and > the speed and window sizes) have changed since 1996 ... my question is > if it is still good practice today to use it? Unless there is some other alternate

Re: tcp_syncookie question

2011-06-01 Thread Genes MailLists
On 06/01/2011 10:40 AM, Bruno Wolff III wrote: > On Wed, Jun 01, 2011 at 10:35:18 -0400, > Genes MailLists wrote: >> >> Networking Gurus: >> >> In the past I've set my firewall to use tcp_syncookies - but this >> prevents certain tcp options - given the current state of the internet - >> can

Re: tcp_syncookie question

2011-06-01 Thread Bruno Wolff III
On Wed, Jun 01, 2011 at 10:35:18 -0400, Genes MailLists wrote: > > Networking Gurus: > > In the past I've set my firewall to use tcp_syncookies - but this > prevents certain tcp options - given the current state of the internet - > can someone opine on whether this should continue to be us

tcp_syncookie question

2011-06-01 Thread Genes MailLists
Networking Gurus: In the past I've set my firewall to use tcp_syncookies - but this prevents certain tcp options - given the current state of the internet - can someone opine on whether this should continue to be used or not? I assume ipv6 is different .. -- users mailing list users@lists