Re: Synflood filtering and Conntrack

["Gáspár Lajos" <swifty@freemail.hu>]

2010-07-29 17:50 keltezéssel, Jozsef Kadlecsik írta:
> I don't see why it looks soo complicated: of course, a ct entry is 
> created
> by conntrack whenever a new connection is detected. And of course the
> entry is destroyed if the packet, which triggered to create the new entry,
> is dropped by a rule. Why should the conntrack entry be kept, if the
> connection is not allowed by the rules?
>
>    
Correct me if I am wrong.

You can only destroy the entry (CONNECTION) if the PACKET which 
"created" the entry is DROPped.
But you can NOT destroy the entry (just wait for timeout) if:
- the DROPped packet is not the first (SYN),
- there is no LOCAL reply,
- packets are FORWARDed.

I think that 99% of the conntrack entries are kept this way until timeout.

It it is true then there is no "standard" real help against a SYN flood. 
(CHAOSTABLES?)


Swifty