RE: FW Sequence Number based statefulness

[Carson Gaspar <carson () taltos org>]

--On Monday, May 14, 2001 2:18 PM -0700 Peter Crocker 
<pcrocker () netscreen com> wrote:

> window. (The window may use an appropriately selected fixed value, say 32
> or 64K, rather than strictly monitoring the window. The implementation

No, it may not. If you do, you'll break large window support. You either 
must make it the largest legal scaled window (which makes for rather easy 
sequence spoofing), or you have to monitor the actual window negotiation, 
or (best) monitor the actual windows being transmitted.

--
Carson

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards