On Thu, 2007-10-25 at 11:54 -0600, Ashley M. Kirchner wrote:
To drop or not to drop, that is the question. If there's a
server
out there sending spam e-mail, and I use iptables to block it, is it
best to simply drop the packet, or should I do a '--reject-with
icmp-host-unreachable' (or 'icmp-port-unreachable') or just a
'tcp-reset'?
Basically, if I just drop the packet, the server in question would
simply continue to send stuff, wouldn't it? As far as it knows, its
spam reached the destination, whereas if I send something back, it might
actually acknowledge and stop? Yes? No?
If you drop, the packets fall on the floor. The remote machine will no
response at all and it appears as if your machine doesn't exist. I
think that's best way to handle it.
If you respond at all (or do a reset), that indicates _something_ is at
that IP and, depending on how big an *sshole the attacker is, may cause
them to try other ways to assault you.
----------------------------------------------------------------------
- Rick Stevens, Principal Engineer rstevens(a)internap.com -
- CDN Systems, Internap, Inc.
http://www.internap.com -
- -
- Perseverance: When you're too damned stubborn to say "I quit!" -
----------------------------------------------------------------------