2010-07-29 17:50 keltezéssel, Jozsef Kadlecsik írta:
I don't see why it looks soo complicated: of course, a ct entry is
created
by conntrack whenever a new connection is detected. And of course the
entry is destroyed if the packet, which triggered to create the new entry,
is dropped by a rule. Why should the conntrack entry be kept, if the
connection is not allowed by the rules?
Correct me if I am wrong.
You can only destroy the entry (CONNECTION) if the PACKET which
"created" the entry is DROPped.
But you can NOT destroy the entry (just wait for timeout) if:
- the DROPped packet is not the first (SYN),
- there is no LOCAL reply,
- packets are FORWARDed.
I think that 99% of the conntrack entries are kept this way until timeout.
It it is true then there is no "standard" real help against a SYN flood.
(CHAOSTABLES?)
Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
