Josip Almasi <joe@vrspace.org> wrote:
there is a scenario that might require "no_response_fail = yes".
First, network breaks; power outage, spanking trees, something other but massive. Then clients start comming online, put some heavy load on backend server. Retry, retry, and - clients DoS backend. In that case I might want to send Access-Reject, to get some breathing space.
Easier and probably much more apprioate to use the OS's firewall to send backsome ICMP related grumbling (TCP RST if you happen to be using TCP) to pretend the port is closed/unavailable. ICMP in response to a UDP packet can get passed back to the application layer, rather than assuming a retry is required. Of course it depends on the OS's firewall, but in the case of iptables you can start doing rather cunning things like hashbuckets, recent and what not. Cheers -- Alexander Clouter .sigmonster says: Phone call for chucky-pooh.