Re: Problem accessing https://my.procurve.com/profile/index.aspx (ACK is over the upper bound)

Krzysztof Oledzki wrote:
> On Mon, 2 Jul 2007, Patrick McHardy wrote:
> 
>> We should really document that with window tracking
and NAT you
>> must drop INVALID packets to avoid them getting
delivered locally
>> and causing a RST.
> 
> 
> Indeed. There should be a big, fat warning about
dropping in INPUT (and
> probably FORWARD). The question is where: Kconfig
(NAT)? man iptables?
> both? ;)


The manpage I guess. Kconfig is not really the place for
this IMO.

>>> make no more RSTs, only retransmisions from the
216.34.143.7. And yes, I
>>> have a patched kernel so I'm able to filter
packets in a PREROUTING
>>> chain.
>>
>>
>> Dropping works without any patches.
> 
> 
> Yes, in INPUT. I discovered that such packets goes to
INPUT shortly
> after I had written this mail. Before that I had put
this in PREROUTING,
> which is not possible by default.


You can drop in PREROUTING/mangle for example. In the filter
table
its not possible of course since there is no PREROUTING
chain