Re: How to stop SYN Flood with Pix firewall? posted 01/26/2003
On Sat, 2003-01-25 at 21:18, d tran wrote:
> I am not sure how many Packets/Sec hping2 generate but I don't think 100BaseT
> was saturated because the whole thing is connected to a Cisco 2924-XL Enterprise
> switch (running 12.05(T)) IOS.
I mentioned this saturation stuff not to suggest that it affect
somehow your observation, but as a estimation of amount of pps.
Linux kernel is fairly capable to generate packets with full
wire speed (I was writing some testing scripts in PERL,
and had no problem with generating 150 kpps)
I just wanted to point out that with 150 kpps, device
creating some data structures representing new TCP
connection for each and every packet, has a hell lot
of work, and maybe, you just reached PIX520 limits...
Besides, Cat switch is nonblocking (well, nearly),
so unicast traffic between your generator and pix will not
affect other ports.