|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] SMTP and Unknown Established TCP packet
That depends really. If you drop ident, inbound mail delivery takes a bit longer. If you reject, then the process mail delivery is sped up. BUT *something* will respond when a script-kiddie scans you boxes. It gives away a tiny piece of information in such a way that suggests "Firewall at IP a.b.c.d". Certainly something *I* would use when performing legitimate scans..! Tom ----------------------------------- Tom Rowan Security Alchemy Ltd. ----------------------------------- -----Original Message----- From: Elisabeth Wonders [mailto:[email protected]] Sent: 27 March 2002 17:03 To: [email protected] Subject: Re: [FW-1] SMTP and Unknown Established TCP packet Is this a situation in which "reject" is preferable over "drop"? I'm dropping ident traffic as part of my catch-all rule. Elisabeth Don <[email protected]> Sent by: Mailing list for To: [email protected] discussion of Firewall-1 cc: <[email protected] Subject: Re: [FW-1] SMTP and Unknown Established TCP packet kpoint.com> 03/27/2002 09:58 AM Please respond to Mailing list for discussion of Firewall-1 > We found out that SMTP connections to many sites took *long* times to > establish. We demonstrated that in that particular case the problem > was lousy service from the ISP, since many sites had problems when connections > were attempted. Connections were being dropped (out of state) since it took > longer than the "handshake" timeout to start exchanging traffic. We > worked-around it taking the 60s default timer to 300s, and advised the > customer to talk to their service provider. The problems being described here sound exactly like an ident timeout is causing the problem. Please make sure that you are _rejecting_ ident traffic to your mail server. If not, some remote systems attempt to perform an ident lookup, and that reverse connection is dropped by your firewall. By the time that ident connection times out, and the mail server goes back to the SMTP session, the connection has also timed out. ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
