Re: [PATCH + RFC] neighbour/ARP cache scalability

[Andi Kleen <ak@xxxxxxx>]

On Tue, Sep 21, 2004 at 11:58:27AM -0600, Tim Gardner wrote:
> On Tue, 2004-09-21 at 11:31, Andi Kleen wrote:
> 
> > But also allows an easy DOS. Someone just has to spoof a lot of connections
> > attempts with the source address of your primary name server or 
> > some other important service.
> > 
> 
> That is what other iptables rules and filters are for. I get thousands
> of source address spoofs from my Internet connection every day. Network
> security is a layered approach.

I don't think you can eliminate the problem with more filters.
Even when you can eliminate spoofing for some services you use
you cannot eliminate it for all possible services your user
use (unless you get rid of spoofing in the whole internet or you never
talk to any services outside your network) 

And certainly the solution wouldn't work as a Linux default.

-Andi