On Thu, Oct 25, 2007 at 11:54:28 -0600, "Ashley M. Kirchner" <ashley@xxxxxxxxxx> wrote: > > To drop or not to drop, that is the question. If there's a server > out there sending spam e-mail, and I use iptables to block it, is it > best to simply drop the packet, or should I do a '--reject-with > icmp-host-unreachable' (or 'icmp-port-unreachable') or just a 'tcp-reset'? Dropping packets from the ident port can potentially cause problems. Sometimes servers will check back there to get a user id (this goes back to when people mostly shared computers, it is pretty pointless today) and if you drop packets things may stall until the connection times out rather than giving up immediately after being told ident isn't available.
