North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Slow and Fast IP addresses on http ?

  • From: Steven M. Bellovin
  • Date: Tue Jun 17 12:58:52 2003

In message <[email protected]>, Daniel Karrenberg 
writes:
>
>tcp-wrapper.
>
>Check DNS of the client address affected, forward and reverse.
>

It might also be port 113 -- some sites try to query your tcp port 113, 
and wait for a timeout if the port is firewalled.  A better solution 
than blocking it is to send an immediate RST.


		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)