This is a discussion on Re: max # of connections per IP ? within the IPFilter forums, part of the System Security and Security Related category; On Mon, Sep 08, 2003 at 03:35:03PM -0400, Chuck Yerkes wrote: > Why? Because there is no good ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
On Mon, Sep 08, 2003 at 03:35:03PM -0400, Chuck Yerkes wrote:
> Why? Because there is no good technical reason for it, really. well, actually it could be quite useful IMHO. FreeBSD's IPFW support it (no intention to start an holy war !! ;))) ) > You've got a request coming from ISO layer 8 (the political layer) > to do something at layer 4. you're quite right about the 8th layer :-D (very nice definition! :) ) > Note also that I can run mozilla and perhaps go to a bookmark that > opens 5 tabs and each tab opens 8 HTTP connections and that one > "go to bookmark" creates 40 TCP connections. > > Is this wrong? no, it's well within the spec's of HTTP and TCP/IP. > Is this bad? Not really. yes, this is definitely true. > This smells to me of a semi-technical person perceiving a solution > to a problem and mandating that when correct and implementable > solutions exist. more or less. let's say it would be a sort of "mitigation factor" for services like P2Ps for clients in our LAN. Other services are already proxy-forced and bandwidth is not, per se, a problem (10Mbps WAN link just for users is not very common here in Italy) but very often we see many thousends of connections coming from a single IP (Win box with some P2P software installed). This would not be an hard-limit according to our company's internal policy, simply it could a "nice" and "useful" thing to do. I guess it would be quite "simple" for Mr. Reed to implement, maybe he'll read this mail and will take a note for future releases... ;-)) -- bye! Ale |