Re: newnotsyn question

Tom Eastep
Thu, 30 Dec 2004 01:23:08 -0000

On Wed, 2004-12-29 at 15:39 -0800, Jack Coates wrote:

> > If you don''t like the messages then don''t use
NEWNOTSYN=No. In a perfect
> > network, NEWNOTSYN=No is a reasonable idea; alas, the Internet is far
> > from perfect. I offer NEWNOTSYN=No because people read books about
> > firewalling and think that they have to have it; once they see it in
> > action, they usually change their mind.
> >
> > -Tom
>
> sensible enough. Back when I was much deeper into firewalls it could be
> done reasonably well on Check Point, but even then they''d break it
with
> every patch as often as not.

I played with this for quite a while -- I could get pretty reasonable
behavior but at a cost if taking most of the teeth out of NEWNOTSYN=Yes.
I concluded that most of the benefits of NEWNOTSYN=Yes could be achieved
with much less impact using the ''tcpflags'' interface option.