2 ms·
I wish they tested a few adversarial conditions as well, like for instance having MANY open nat connections. At some point the memory runs out, right ?
by candiodari 8y ago
I wish they tested a few adversarial conditions as well, like for instance having MANY open nat connections. At some point the memory runs out, right ?
- SolalPirelli 8y agoThe size of the flow table is configurable, and the NAT drops connections once the table is full. (Of course, the NAT also expires old connections)
- candiodari 8y agoInteresting. Does it keep actively used connections open so as to maintain as much functionality as possible if it's under attack ?
- SolalPirelli 8y agoYes, existing connections are kept as long as there is traffic often enough (in either direction) - the timeout is configurable.
- loxias 8y agoThis is truly amazing work, I'm glad you chose Nat as your NF example. One minor question I haven't seen answered anywhere: For vignat, in the git repository and the paper, I see no mention of software license. May I assume that it is in the public domain, or if not, BSD licensed?
- SolalPirelli 8y agoGood point. Will talk about it with the other authors. Thanks.