Yeah, yeah, yeah... the firewalling code does a good job of preventing crap
from entering the network, but I don't want kernel memory wasted to block
thousands of sites/IP ranges. And figuing how often any of those sites
will try to connect, it makes even more sense to put this partically in user
space.
>> - Block the connection all together (silently drop the syn)
>> (ICMP dest unreachable)
>
>Can do those
I didn't think the firewall could "silently" drop the traffic.
>> The connection can be dropped anywhere from verification of the helo to the
>> '.' terminating the data [after hours of sending data at bytes per minute
>> speeds :-)]
>
>Sending a TCP MSS of 4 is quite funny
Doesn't the MSS include the TCP/IP header overhead? I wonder if the IP stack
would go nuts with an MSS of 0?! :-) [Oooo... MSS = 4, WIN = 1 ]
--Ricky