On Thu, Jan 2, 2014 at 7:22 PM, Dobbins, Roland <[email protected]> wrote:
> > On Jan 3, 2014, at 12:17 AM, Mack McBride <[email protected]> > wrote: > > > The big problem with DDoS is pipe filling anyway, not CPU load. > > That's entirely subjective and varies from attack to attack, FYI. > > And to be carify, the issue with putting stateful anything in front of > servers isn't primarily CPU load (although it certainly can be a factor), > but rather state-table memory exhaustion. > > My reasoning on putting something stateful was to have it timeout connections in 2-3 seconds max (Windows for example has 2 sec. DNS server query timeout). With modern machines (from a few years back) you can track a lot of connections effortlessly. The whole idea with the stateful filtering was to make the machines drop unwanted traffic before it reaches the DNS daemon, assuming it takes less time for iptables/pf to match this kind of traffic in kernel space than it takes a resolver in userspace. I am a big fan of non-statefeul things when they are warranted, but in some cases I see the point of statefulness. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
