Re: ip contrack problem, not strictly followed RFC, DoS very much possible

[Jose Luis Domingo Lopez]

On Monday, 06 December 2004, at 14:54:59 +0100,
Grzegorz Piotr Jaskiewicz wrote:

> If someone has argumentation for 5 days timeout, please speak out. In 
> everyday life, router, desktop, server usage 100s is enough there, and 
> makes my life easier, as many other linux admins.
> 
Maybe five days is a bit high, but there are definitely many (maybe badly
designed) applications that expect a TCP connection to remain open (and
traffic not dropped) for much longer than your proposed 100 seconds.

It is not unusual the need to tweak the settings for several commercial
firewalls I work with in several customers to raise the default timeouts
for TCP connection tracking, because some application breaks if the
connection gets put out of the firewalls' connection tables and the
traffic dropped.

Many times is just "my users are too lazy to double click the 'start
connection' icon again when they come from their breakfast, and want to be
able to enter commands on the remote host again". But at least, the
parameter is tunable in recent kernel versions, and not hardcoded in the
kernel sources like it was some time ago.

Greetings.

-- 
Jose Luis Domingo Lopez
Linux Registered User #189436     Debian Linux Sid (Linux 2.6.10-rc3)

Attachment: signature.asc
Description: Digital signature