Florin Andrei wrote:
>
> This sounds like a job for the firewall, but on the other hand all those
> servers are very fast, there's a lot of them, and usually they're mostly
> idle. So I'm very tempted to dump that task on the servers.
OTOH, if I let the servers deal with it, wouldn't that fill up resources
on the firewall real quick during an attack? So in that case, syncookies
at the firewall level would be better.
I will do some tests to trigger some issues that might occur in real
life and see how each piece of equipment handles that, but until then
I'd like to get a second opinion, so that's why I'm asking.
--
Florin Andrei
http://florin.myip.org/
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
|