Subject: Re: kerb problems (Re: can't migrate master key to Heimdal)
To: Jason R Thorpe <thorpej@zembu.com>
From: John Hawkinson <jhawk@MIT.EDU>
List: current-users
Date: 07/02/2000 17:56:01
| ICMP error rate limiting is mandatory in IPv6, and is also good to
| have in IPv4 for the same reason's it's mandatory in IPv6.

True. IPv4 router requirements recommends it, and it's standard practice
for routers. However:

| One of those reasons is to prevent denial-of-service.

It is clear that what is in -current and netbsd-1-5 right now is
extremely poorly tuned.

Itojun and I had a long discussion about this last month and
we didn't actually reach any code as a result, but I think
it made clear a number of thinsg that had to happen.

I will summarize it to tech-net and see what we can do about it.

If we don't have a good fix, personally, I think that turning it
off in 1.5 is better than leaving it on in this broken state.

Clearly rate-limiting localhost differently from other machines
is a kludge and indicates the limit is rather problematic.

--jhawk