Hello,
For SYN flood protection, it seems OpenBSD's pf deploys something they call
a "SYN proxy" whereby the 3 step TCP handshake is completed by this proxy so
as to avoid SYN floods to the actual target.
This OpenBSD pf feature is described here:
http://www.openbsd.org/faq/pf/filter.html#synproxy
The target is only brought into the picture if and when the handshake is
complete.
I guess pf must then adjust the real target's sequence numbers so as not to
confuse the initiator of the connection.
Has something like this been implemented via iptables?
If not, are there any plans to do so?
Thanks,
- Andrew Kraslavsky
_________________________________________________________________
MSN is giving away a trip to Vegas to see Elton John. Enter to win today.
http://msnconcertcontest.com?icid-nceltontagline
