On Fri, 28 Oct 2005, Jari Arkko wrote:
But if that's true: all the more reason to support suppressing the shim header for rewritten packets. :-)The same said firewalls could be dropping packets that are part of a TCP stream that was not initiated through this firewall...
1) tcp stream could have been initiated through the firewall -- all depends on the firewalls placement
2) if there are multiple, they often have methods to sync their rules and state.
3) the fw could have policies which are lax enough "allow tcp established" which is often the case if 2) cannot apply.
-- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings