3 ms·
You can simply send a ICMP Rejected Message, which should direct your browser to immediately try any fallbacks or other hosts. Timeouts occur when you incorrec
by zaarn 6y ago
You can simply send a ICMP Rejected Message, which should direct your browser to immediately try any fallbacks or other hosts.
Timeouts occur when you incorrectly configure your firewall to drop packets instead of rejecting.
- xg15 6y agoTrue, that would work as well. Though I believe it's recommended as a best practice to simply drop packets as not to help port scanners.
- zaarn 6y agoI don't worry about port scanners. If your infrastructure becomes less secure because of a port scanner, it's not very well secured. Sending a REJECT is cheap, no DDoS opportunity and helps browsers and other apps fail over fast. The recommended practise I've heard everywhere is that an ICMP REJECT provides no opportunities for an attacker they wouldn't have with 10 minutes extra time (modern port scanners can be set aggressive enough that REJECT or DROP doesn't matter if they have a known open port they can obtain an ACCEPT timeline from).
- xg15 6y agoYeah, that absolutely makes sense - as I said, a site could also avoid the timeout by sending a TCP RST packet. My point was more that I believe not many sites are doing any of this as in the past, "best-practice" firewall configuration was to be as silent as possible.
- zaarn 6y agoBeing as silent as possible has only two effects; an attacker takes 2 seconds longer and you significantly degrade the network experience of all your users. It hasn't been best-practise in a while (outside the greybeard firewall admin circles), ie, almost a decade at this point. Anyone who hasn't figured that out should really consider not doing network admin if their knowledge is a decade out of date.
- xg15 6y agoHmm, OK. Might be that my knowledge was not really up-to-date there. I'd really appreciate if network protocols designed for common benefit (such as ICMP) are not discouraged due to security for a change. In this case, sorry for spreading FUD, that wasn't my intention.