Date: Fri, 1 Apr 2005 09:25:40 +0100 From: Chris <chrcoluk@gmail.com> To: freebsd-stable@freebsd.org Subject: ipoptions sysctl option Message-ID: <3aaaa3a050401002558c6dc60@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi I read the pdf detailing new changes in 5.3 networking and noticed a new sysctl variable is added 'net.inet.ip.process_options' Here is the description. "IP Options do not have any practical use today. The only useful application is RR (Record Route) where it remembers the last 8 hops the packet traversed through. That allows you to check parts of the path back to you. IP options processing is rather expensive because the packet header has to be modified and expanded. In addition the only other use is to circumvent or trick firewalls thus it is normally blocked there. The options are these: (By: andre) # sysctl net.inet.ip.process_options=0 Possible Modes: net.inet.ip.process_options=0 Ignore IP options and pass pkts unmodfied net.inet.ip.process_options=1 Process all IP options (default) net.inet.ip.process_options=2 Reject all pkts with IP options with ICMP IPv4 Processing" As it says above mine is set to 1 the default, would setting it to 0 help with things like DDOS attacks because it is processing less and what side affects if any could I expect from ignoring ip options? thanks Chris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3aaaa3a050401002558c6dc60>