Re: TCP syncookies - firewall or host?

[rgolodner () infratection com]

 Why even allow the servers to see all of those options and thebn have to decide. I myself think PIX should drop it all 
at the external interfaces and never have to process anything further than that.

> -----Original Message-----
> From: Florin Andrei [mailto:florin () andrei myip org]
> Sent: Tuesday, April 3, 2007 04:13 PM
> To: 'Firewall Wizards Security Mailing List'
> Subject: [fw-wiz] TCP syncookies - firewall or host?
>
> Speaking about SYN flood - where would you handle it, at the firewall 
> level, or at the host level?
>
> Practical example:
> A PIX-515E running v7.2.2, 128MB RAM
> About 16 servers running Red Hat Enterprise 4, 8 GB RAM each, 4 CPU 
> cores (recent AMD64 CPUs), all of them behind the firewall
>
> syncookies can be enabled either at the firewall level, or at the host 
> level. Also, all kinds of TCP parameters can be tweaked on the firewall 
> (intercept and connection limits) but also on the servers via the /proc 
> filesystem.
>
> This sounds like a job for the firewall, but on the other hand all those 
> servers are very fast, there's a lot of them, and usually they're mostly 
> idle. So I'm very tempted to dump that task on the servers.
>
> Pros and cons?
>
> -- 
> Florin Andrei
>
> http://florin.myip.org/
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () listserv icsalabs com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards