Re: Add seperated timeout for the connections that only receive packets in one direction

On Mon, Nov 30, 2009 at 7:10 PM, Patrick McHardy <kaber <at> trash.net> wrote:
> Changli Gao wrote:
>> Case 2:
>>
>> Attacker ---+
>>                 +-- Linux Router --> WAN
>> Victim-------+
>>
>> If we do sth. like RPF before entering conntrack, the packets in the
>> other direction won't be in.
>
> RPF doesn't help since its also done after conntrack.
>

I didn't mean RPF. I meaned some other thing like RPF before conntrack.

--

-- 
Regards，
Changli Gao(xiaosuo <at> gmail.com)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo <at> vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html