diff options
| author | Daniel Hartmeier <dhartmei@cvs.openbsd.org> | 2003-05-16 17:15:18 +0000 |
|---|---|---|
| committer | Daniel Hartmeier <dhartmei@cvs.openbsd.org> | 2003-05-16 17:15:18 +0000 |
| commit | 85e053e7501287b4034b58a3a8435bf906ed929e (patch) | |
| tree | 09f5e7909516434e61974fc7b1e719ed8d2d993e /sbin/wicontrol | |
| parent | d9525b078e57b78143c603ae3eb262ad75798b49 (diff) | |
TCP SYN proxy. Instead of 'keep state' or 'modulate state', one can use
'synproxy state' for TCP connections. pf will complete the TCP handshake
with the active endpoint before passing any packets to the passive end-
point, preventing spoofed SYN floods from reaching the passive endpoint.
No additional memory requirements, no cookies needed, random initial
sequence numbers, uses the existing sequence number modulators to translate
packets after the handshakes.
ok frantzen@
Diffstat (limited to 'sbin/wicontrol')
0 files changed, 0 insertions, 0 deletions