Re: iptables denial of services

[Friedrich Lobenstock <fl@fl.priv.at>]

Henrik Nordstrom wrote on 16.04.2004 12:03 MET:
> On Thu, 15 Apr 2004, Jorge Garcia wrote:
> 
>>Is this a problem in iptables firewall??i mean does iptables stop filtering after handling a lot of traffic?
> 
> No, but it may start dropping packets if overloaded.
> 
> If you are doing connection tracking then there is also an analogy to the
> connection flooding, where conntrack will not accept new sessions when a
> huge number of connetions is already established and this will most likely
> result in those new sessions to dropped by your firewall. But it is not a
> risk that filtering stops, only that new connections may not be accepted 
> for a while. The number of sessions involved is considerably higher than 
> on a server so your servers will most likely be dead long before the limit 
> in conntrack can be reached.

What if the server you are talking about is a server farm? Then an iptables 
gateway that does connection track on the way may as well "die" before the 
servers "die" because of overload.

Can you give some details about those limits? Are there any numbers 
availabe that relate that to memory/cpu/....?

-- 
MfG / Regards
Friedrich Lobenstock