On Thu, May 20, 2010 at 10:32 PM, Eric Dumazet <eric.dumazet@xxxxxxxxx> wrote: > Le jeudi 20 mai 2010 à 22:21 +0800, Changli Gao a écrit : > >> >> pure synproxy can be used on firewall to protect the internal servers, >> which don't support neither syncookies and synproxy, from the attack >> of SYN-flood. >> > > protecting servers using conntracking ? > > Thats seems very dangerous to me. If NAT is needed, conntracking is needed in any way. The conntrack won't be confirmed until the connection between firewall and client is established. > >> synproxy with defered connection relay acts as a layer 7 proxy, but >> works in kernel space totally, unlike tcp splice tech., which needs >> the applications in user space parse the requests, and establish the >> connections. >> > > In the example given, only non persistent connections are handled... > > These days, browsers and servers dont establish one socket per http > request... > > Yea. But some users still use non persistent connections, as they want to fetch URLs in parallel. -- Regards， Changli Gao(xiaosuo@xxxxxxxxx) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
