Re: ip_vs_random_dropentry

[Julian Anastasov <ja@xxxxxx>]

        Hello,

On Wed, 28 Sep 2005, Jacob Coby wrote:

> I've been looking at the source code for ipvs 1.0.10 and noticed that
> ip_vs_random_dropentry does not send a RESET packet to the realserver.
> It is my understanding that this feature is to prevent SYN flood (and
> related) attacks, but it doesn't seem like it would be effective as the
> realserver will continue to SYN/ACK until it reaches tcp_synack_retries.
>   You've potentially saved the director from attack, but lost the
> realserver(s).

        In old days we were sending ICMP error, now it is disabled with
nat_icmp_send sysctl. Is it enabled in your setup?

> Am I missing something, or is this by design?

Regards

--
Julian Anastasov <ja@xxxxxx>