>>>>> "itojun" == itojun  <itojun@iijlab.net> writes:
    itojun> how about an (additional) ipf rule during bootstrap?

  I'm not sure I understand your point here. I'm just suggesting something
like the following, with tcp_silent_refused being sysctl'able. The idea
to let the initiator keep trying instead of shutting them down immediately.

  (I notice this while doing "make && scp netbsd mhost:" while mhost is
still rebooting from db>... )

phobos-[/usr/src/sys/netinet] mcr 87 %cvs diff -u tcp_input.c 
Index: tcp_input.c 
=================================================================== 
RCS file: /cvsroot/syssrc/sys/netinet/tcp_input.c,v 
retrieving revision 1.108.4.8 
diff -u -r1.108.4.8 tcp_input.c 
--- tcp_input.c 2001/04/06 00:25:58     1.108.4.8 
+++ tcp_input.c 2001/05/27 00:48:35 
@@ -862,7 +862,11 @@ 
                                    src, ntohs(th->th_sport)); 
                        } 
                        TCP_FIELDS_TO_HOST(th); 
-                       goto dropwithreset_ratelim; 
+                       if(tcp_silent_refused) { 
+                         goto drop; 
+                       } else { 
+                         goto dropwithreset_ratelim; 
+                       } 
                } 
 #ifdef IPSEC 
                if (inp && ipsec4_in_reject(m, inp)) {