SYN floods continue
Perry E. Metzger
perry at piermont.com
Fri Sep 13 16:34:16 UTC 1996
Jim Forster writes:
> > Again, the rule is "dont accept packets from an interface if there's no
> > route for their source addresses pointing back to the same interface".
> > Note that that route does not have to be the best one -- just that the
> > router gets it from somewhere.
>
> Without discussing it with the right folks here ahead of time, I suspect we
> could do this at good speed in some, but not all routers, in our product
> line.
[...]
> Now the big question: is this useful in routers carrying a default route?
I'm not entirely sure about what you mean, but I'd envision that the
best place to do this filtering would be in routers attached to
"end" customers, which frequently use default routes.
Perry
More information about the NANOG
mailing list