On Mon, Nov 30, 2009 at 7:10 PM, Patrick McHardy <kaber@xxxxxxxxx> wrote: > Changli Gao wrote: >> Case 2: >> >> Attacker ---+ >> +-- Linux Router --> WAN >> Victim-------+ >> >> If we do sth. like RPF before entering conntrack, the packets in the >> other direction won't be in. > > RPF doesn't help since its also done after conntrack. > I didn't mean RPF. I meaned some other thing like RPF before conntrack. -- Regards， Changli Gao(xiaosuo@xxxxxxxxx) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
