Re: [FW-1] SMTP and Unknown Established TCP packet

[James Schnack <acrux14@FW1-NOSPAMHOTMAIL.COM>]

I thought I had replied to this message, but did not see my reply posted. I
will try again... (sorry if was the only one that did not receive my
message! ;)

The answer is NO, it is not advisable. By definition, it makes the FW more
vulnerable to a DOS attack that would fill up the connection table (i.e. a
SYN flood, although there are other mechanisms to stop this which you
probably have already in place). I suggested it only as a workaround (I
should have added the word "temporary" to that!) while you checked for
network problems.

I insist on the following (quote from original):

---------------BEGIN_QUOTE---------------
> If you want to make sure, download VisualRoute, install it on a laptop and
> place it just outside the FW with a public IP. Then point VR to some of
> the
> problematic sites and you may eventually see routing loops or long delays
> on
> specific links on the way to them. They have a handy 30d eval version at
> http://www.visualware.com/download/index.html.
---------------END_QUOTE---------------

Just my thoughts. Let me know how the story ends, when it does...!   ;)

Regards,

J.



> Thanks James.
> U did solve my problem to a greater extent. And increasing the timer
> (tcpstarttimeout)  to 300 sec did work. but is it advisable to put a such
> a large value ? I am little worried there. Anybody has any comments?


_________________________________________________________________
Join the world?s largest e-mail service with MSN Hotmail.
http://www.hotmail.com

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================