In reply to Paul Jakma's flatulent wordings,
> On Mon, 26 Jun 2000, Smelly Pooh wrote:
>> > To get a rise out of you paul
>> fyi i'm still sitting.
>> [snip discussion of static vs statefull firewalling]
>> > The 2 free firewall packages I know of that keep state are ipfw (for
> > FreeBSD) and ipfilter (which is surprisingly portable for a packet
> > filter, runs on *BSD, solaris, irix, hpux and even Linux, although
> > from what I hear the Linux version only works with older kernels).
> > Commercial packages like Firewall-1 also keep state.
>> the one thing you left out:
>> stateful firewalling by it's very nature needs a lot more resources
> compared to static rule fw, esp wrt to memory. so the linux view is
> probably: 'doesn't belong in kernel -> belongs in user space' ie a
> firewalling application.
It turns out that linux 2.4.x will have stateful firewalling afterall (and all
this despite the linux view I tell you :}). I just don't get it, it takes up
so much more resources, (esp wrt to memory) and adds so much complexity, yet
the maintainer of the Linux 2.4 Packet Filtering HOWTO had the audacity to
"The most useful match criterion is supplied by the `state' extension, which
interprets the connection-tracking analysis of the `ip_conntrack' module. This
is highly recommended."
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!