|
Author: Alexander Leidinger
Date: 13-06-03 11:23
Hi,
a "deny" rule results in silently discarding a matching packed, a "reject" rule causes the network stack to generate an answer ("not reachable").
So if any program (may it be IRC or sendmail or whatever) tries to connect to the IDENT service of a "deny" protected host, it has to wait until a timeout occours.
With a "reject" rule the program usually doesn't has to wait that long, because it gets an answer before the timeout is reached.
Instead of allowing the access to IDENT (if you haven't it explicitely activated in inetd.conf, there's nothing running anyway) you could "reject" connections while still getting the same benefit.
Bye,
Alexander.
|
|
  |
Cause of long connection times (IDENT, deny, reject) new |
|
Alexander Leidinger |
13-06-03 11:23 |
|
Dan Langille |
14-06-03 18:24 |
|
Chris Phillips |
11-07-04 23:30 |
|
