Le jeudi 20 mai 2010 à 22:21 +0800, Changli Gao a écrit : > > pure synproxy can be used on firewall to protect the internal servers, > which don't support neither syncookies and synproxy, from the attack > of SYN-flood. > protecting servers using conntracking ? Thats seems very dangerous to me. > synproxy with defered connection relay acts as a layer 7 proxy, but > works in kernel space totally, unlike tcp splice tech., which needs > the applications in user space parse the requests, and establish the > connections. > In the example given, only non persistent connections are handled... These days, browsers and servers dont establish one socket per http request... -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
