I don't need no stinking firewall!

Sun Jan 10 10:45:47 UTC 2010

On Jan 10, 2010, at 3:48 PM, James Hess wrote:

> Firewalls do not need to build a state entry for
> partial TCP sessions,  there are a few different  things that can be
> done,  such as  the firewall answering on behalf of the server (using
> SYN cookies) and negotiating connection with the server after the
> final ACK.

The firewall capacity for doing this can be easily overwhelmed; and again, well-formed traffic can simply 'crowd out' good traffic.  The other drawbacks of the stateful firewall further outweigh even this negligible benefit.

Fronting one's Web server farms/load-balancers with a tier of transparent reverse-proxy caches is a better way to scale TCP connection capacity, as well as the myriad other benefits offered (described earlier in this thread).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

    Injustice is relatively easy to bear; what stings is justice.

                        -- H.L. Mencken