Date: Tue, 13 Nov 2007 18:57:34 +0530 From: Girish Venkatachalam <girishvenkatachalam@gmail.com> To: freebsd-questions@freebsd.org Cc: Erik Osterholm <freebsd-lists-erik@erikosterholm.org> Subject: Re: PF, bridge, states and window scaling problem Message-ID: <20071113132734.GA16728@saraswathy.susmita.org> In-Reply-To: <20071113054220.GA74564@aleph.cepheid.org> References: <669132de0711121208n32bfb827p4984c6d3383da713@mail.gmail.com> <20071113022053.GA17768@saraswathy.susmita.org> <20071113054220.GA74564@aleph.cepheid.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 23:42:20 Nov 12, Erik Osterholm wrote: > My understanding (and please correct me if I'm wrong) is that > keeping state requires fragmented packet reassembly, which can break > some applications. You mean that you cannot support "broken applications" if you do reassembly? Packet reassembly happens if you use a scrub rule as well. The main problem with fragmentation leaving aside all performance and security considerations is that you cannot figure out anything useful from the IP fragments. The headers simply lack enough information for you to deduce anything. Reassembly does have an overhead..you can perhaps mention a delay involved in waiting for all fragments to arrive. But AFAIK it only helps if you reassemble. Never hurts. I am not aware of any breakage due to reassembly. ( But I could be ignorant). Now I specifically asked about scrub because scrub does a lot of other things which might "correctly" break "broken applications." I just wanted to give him enough rope. Very likely scrub causes no harm. Neither would keeping state... > Also, I've always followed the conventional wisdom > that bridges shouldn't keep state. A posting from the maintainer > supports this: > http://lists.freebsd.org/pipermail/freebsd-pf/2005-September/001481.html > > Maybe this has changed--I'm not sure, but so far I haven't seen > performance issues with pf and if_bridge without keeping state, so I > haven't been worried about it. I just read the post you linked. Thanks. :) I would imagine that bridges would make things difficult for pf. I have never worked with bridges , so I cannot comment. Sorry. regards, Girish
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20071113132734.GA16728>