Re: ICMP dest-unreach in SYN_* states of TCP

[Jamie Lokier]

[EMAIL PROTECTED] wrote:
> > If I set a rule to reject your connection's packets, this is NOT a
> > transient thing. Retrying the packet will simply elicit another rejection
> > from the firewall... 
> 
> How did the packet reach this firewall? Firewall (if it is not
> embedded to destination host) cannot differ packets lost in the internet
> of "administaratively obeyed" to it.

   It is an ICMP _port_ unreachable.

   Transient routing failures never generate this.  host_unreach and
   net_unreach are considered transient but not port_unreach.  See the
   comment above icmp_err_convert table.

-- Jamie
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]