Date: Mon, 28 May 2001 12:03:48 +0200 From: Sheldon Hearn <sheldonh@uunet.co.za> To: patl@phoenix.volant.org Cc: freebsd-security@freebsd.org Subject: Re: ipfw: reset -vs- unreach port Message-ID: <51156.991044228@axl.fw.uunet.co.za> In-Reply-To: Your message of "Mon, 28 May 2001 00:55:45 MST." <ML-3.4.991036545.6838.patl@asimov.phoenix.volant.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 28 May 2001 00:55:45 MST, patl@Phoenix.Volant.ORG wrote: > There are a few 'nuisance' TCP services that are normally blocked by > firewalls (e.g., auth [113] and netbios-ns [137]) In the interest > of reducing the delays which would be imposed by simply dropping > those packets, is it better to use 'reset' (send an RST), 'unreach > port' (send a Port Unreachable ICMP message), or 'unreach filter-prohib' > (send a Filter Prohibition ICMP message) ? Yes. Ciao, Sheldon. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?51156.991044228>