On Jan 10, 2010, at 3:48 PM, James Hess wrote: > Firewalls do not need to build a state entry for > partial TCP sessions, there are a few different things that can be > done, such as the firewall answering on behalf of the server (using > SYN cookies) and negotiating connection with the server after the > final ACK.
The firewall capacity for doing this can be easily overwhelmed; and again, well-formed traffic can simply 'crowd out' good traffic. The other drawbacks of the stateful firewall further outweigh even this negligible benefit. Fronting one's Web server farms/load-balancers with a tier of transparent reverse-proxy caches is a better way to scale TCP connection capacity, as well as the myriad other benefits offered (described earlier in this thread). ----------------------------------------------------------------------- Roland Dobbins <rdobb...@arbor.net> // <http://www.arbornetworks.com> Injustice is relatively easy to bear; what stings is justice. -- H.L. Mencken
