Date: Fri, 21 Jan 2000 10:41:23 -0700 From: Brett Glass <brett@lariat.org> To: David G Andersen <danderse@cs.utah.edu> Cc: rbezuide@oskar.dev.nanoteq.co.za (Reinier Bezuidenhout), robinson@netrinsics.com (Michael Robinson), freebsd-security@FreeBSD.ORG Subject: Re: stream.c workaround clarification Message-ID: <4.2.2.20000121103732.01a619a0@localhost> In-Reply-To: <200001211643.JAA02231@faith.cs.utah.edu> References: <4.2.2.20000121093753.01a51ba0@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
At 09:43 AM 1/21/2000 , David G Andersen wrote: >Lo and behold, Brett Glass once said: > > > No, IPFW can't do it without assistance from another program, > > which has not yet been written. > > And which I'd wager you won't want to do. The overhead of pushing the >acks into usermode will clobber you just as badly. The ring transition would take time, but the even bigger hit would be maintaining session tables. That work is redundant, because the kernel has to do it too. The programming effort is better spent on the kernel, unless you're firewalling downstream machines. In which case, it'd be better to modify IPFW's kernel code or use IPFilter. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4.2.2.20000121103732.01a619a0>