On Thu, 2007-10-25 at 11:54 -0600, Ashley M. Kirchner wrote: > To drop or not to drop, that is the question. If there's a server > out there sending spam e-mail, and I use iptables to block it, is it > best to simply drop the packet, or should I do a '--reject-with > icmp-host-unreachable' (or 'icmp-port-unreachable') or just a 'tcp-reset'? > > Basically, if I just drop the packet, the server in question would > simply continue to send stuff, wouldn't it? As far as it knows, its > spam reached the destination, whereas if I send something back, it might > actually acknowledge and stop? Yes? No? If you drop, the packets fall on the floor. The remote machine will no response at all and it appears as if your machine doesn't exist. I think that's best way to handle it. If you respond at all (or do a reset), that indicates _something_ is at that IP and, depending on how big an *sshole the attacker is, may cause them to try other ways to assault you. ---------------------------------------------------------------------- - Rick Stevens, Principal Engineer rstevens@xxxxxxxxxxxx - - CDN Systems, Internap, Inc. http://www.internap.com - - - - Perseverance: When you're too damned stubborn to say "I quit!" - ----------------------------------------------------------------------
