From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Kaastrup" Subject: Iptables - disable statefull inspection? Date: Thu, 12 Dec 2002 12:12:19 +0100 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <000001c2a1cf$55f818a0$2864a8c0@pcjka> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C2A1D7.B7BC80A0" Return-path: To: Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org This is a multi-part message in MIME format. ------=_NextPart_000_0001_01C2A1D7.B7BC80A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi I am working with IT-security, and we are testing Peoples security. The problem is, we have an automatic scanner, which sends a lot of SYN_SENT packets. I want to disable the connections in ip_conntrack, because it completely kills the CPU because ip_conntrack reach Maximum connection. I could use another firewall, but I do really like Iptables. I am very sure there must be a way to disable connection tracking and still use Iptables for other services? Med venlig hilsen / Best Regards Jan Kaastrup System Administrator jka@protego.dk Mobil: 29 91 25 15 PROTEGO ------=_NextPart_000_0001_01C2A1D7.B7BC80A0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi

I am working with IT-security, and we are testing = Peoples security.

The problem is, we have an = automatic scanner, which sends a lot of SYN_SENT = packets.

I want to disable the connections in ip_conntrack, because it completely kills the CPU because ip_conntrack reach Maximum connection.

I could use another firewall, but I do really like = Iptables.

 

I am very sure there must be a way to disable = connection tracking and still use Iptables for other = services?

 

 

Med venlig hilsen / Best = Regards

Jan Kaastrup

System Administrator =

jka@protego.dk

Mobil: 29 91 25 = 15

PR= OTEGO

 

------=_NextPart_000_0001_01C2A1D7.B7BC80A0--