3 ms·
> No, a stateful firewall keeps state per connection, not per address, the number of distinct addresses is of no consequence. which is all well until it isn't:
by pilif 11y ago
> No, a stateful firewall keeps state per connection, not per address, the number of distinct addresses is of no consequence.
which is all well until it isn't:
http://blog.bimajority.org/2014/09/05/the-network-nightmare-that-ate-my-week/ http://blog.bimajority.org/2014/09/05/the-network-nightmare-...
- darkr 11y agoThat blog post was referencing issues with FIB/TCAM/multicast state table exhaustion on switches with a small entry limit (3000), brought on by nodes with lots of IPv6 addresses, each with their own multicast group. All of the protocols involved in this are mostly contained within the same layer 2 domain. A "stateful firewall" is generally a firewall that is tracking TCP and UDP packets (i.e L4 and above), so should be unconcerned with anything operating below this layer[1]. A TCP connection is a TCP connection whether running over IPv4 or IPv6. [1]: Things become more convoluted when you have "switches" providing L3 or above functionality, but the problem referenced really is at the switching layer.