5 ms·
I think it can be useful when the TCP connection is going through NAT which may drop the rule and stop passing packets after idling, no?
by 0x0 13y ago
I think it can be useful when the TCP connection is going through NAT which may drop the rule and stop passing packets after idling, no?
- mschuster91 13y agoYep, crappy routers tend to do this :/
- fulafel 13y agoIt's not a real router if it does NAT. NAT is just a half assed proxying hack for hosts not on the internet.
- feld 13y agoA Juniper MX960 can do NAT. Is that not a router?
- fulafel 13y agoIf it's configured to do NAT instead of routing, then it's not being a router. Routing is a job and "router" describes a role, not a static property of a box. Like firewall, bridge, etc. Routing is defined as shuffling packets where they need to go unmolested - without messing with the address or port fields. It's specced in the IP RFC's. If you're mangling the traffic, you're violating router requirements.
- feld 13y agoYou're never seen a router have to do NAT for two subnets that it's routing between?
- jlgaddis 13y agoWhile I certainly share your dislike of NAT, this is just absurd.
- carey 13y agoIn retrospect, I think using TCP_KEEPALIVE would be a better solution to this specific use case. Are TLS heartbeats truly indistinguishable from normal traffic?
- pstrateman 13y agoTCP Keepalive is a much better solution for this problem. Nearly all bitcoin pools utilize TCP keepalive to maintain connections with miners. These are systems in which performance and DoS resistance are paramount.
- lsaferite 13y agoMy understanding, from the heartbleed page, is that the packets for the heartbeat have a specific packet type identifier and that you can use this to train an IDS to watch for the heartbleed attack. I would guess that makes them identifiable?