Re: SYN floods continue

["Perry E. Metzger" <perry () piermont com>]

Jim Forster writes:
> > Again, the rule is "dont accept packets from an interface if there's no
> > route for their source addresses pointing back to the same interface".
> > Note that that route does not have to be the best one -- just that the
> > router gets it from somewhere.
>
> Without discussing it with the right folks here ahead of time, I suspect we
> could do this at good speed in some, but not all routers, in our product
> line.
[...]
> Now the big question: is this useful in routers carrying a default route?

I'm not entirely sure about what you mean, but I'd envision that the
best place to do this filtering would be in routers attached to
"end" customers, which frequently use default routes.

Perry
- - - - - - - - - - - - - - - - -