RE: [SQU] Bind pinging ?

True, true... I got most icmp allowed...
Mmm I'll check it out, maybe a slight mistake on my side ;-)
Thanks.

-----Original Message-----
From: hno@hem.passagen.se [mailto:hno@hem.passagen.se]
Sent: 17 February 2001 09:44
To: David Wilson
Cc: squid-users@ircache.net
Subject: Re: [SQU] Bind pinging ?

David Wilson wrote:
>
> True, but damn it's irritating in my Linux ipchains firewall logs ;-)
> Thanks for the guidance anyways.

It you get firewall log entries for normal ICMP packets which are part
of normal TCP/IP communication then you need to fix your firewall to not
drop those packets, else some parts of TCP will behave badly.

It is mainly the "destination unreachable" family of ICMP packets that
you need to allow. Used by
  UDP when the receiver is not listening (commonly seen in DNS from the
client to the server due to timing, but not critical for the operation)
  TCP for Path MTU discovery (quite critical. TCP hangs otherwise)
  IP to speed up the failure notice when you try to go to a destination
host that is unreachable (good, but not critical)

--
Henrik Nordstrom
Squid hacker
--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html