Now what is 100,000 entries? With the timeout aggressively set at 10
secs (heck, with 10 secs I sometimes cannot even get all the images on
home.netscape.com) it's only 1000 SYNs/sec. How many hosts you want to
protect with such a firewall?
A timeout of 10 seconds is on two packets going back and forth.
Many have said that the timeout must be much higher. I just don't
see it. A SYN arrives. A SYN-ACK is sent out. A 10 second timer
starts that is counted down to 0. An ACK of that SYN-ACK arrives
back within the 10 seconds and we set up the connection. If the
two packets can't each go one way in 10 seconds, the SYN will be
The timeout isn't on open connections, just on embryonic ones.
So let's say 1,000,000 entries: But even 100k entries at 10 seconds
allows for 10k packets/sec, which is 2 * what you can receive in a maxed
My preferred approach is to not even have to store state on any
of the embryonic connections. And to implement the fix on all
of my hosts. And customers can implement it in a firewall, if
they choose (and have boxes which can't be fixed: Win95, NT, Macs, ...).