HP-UX IPFilter Version A.03.05.14 Administrator's Guide

Dynamic Connection Allocation

DCA with HP-UX IPFilter

Chapter 3 45

DCA with HP-UX IPFilter

An HP-UX IPFilter system can act as a secure intermediary, tracking all

incoming TCP connections to a system or network. DCA lets you limit

incoming TCP connections passing through an IPFilter system. DCA

uses stateful packet inspection to limit the number of incoming TCP

connections to a system.

To use DCA functionality, be sure DCA mode is enabled. For more

information, see “DCA Mode” on page 61. DCA functionality does not

work if DCA mode is not enabled.

Overview: DCA Functionality

DCA provides a set of flexible rules for controlling incoming TCP

connections. You allocate a number of TCP connections to a system using

a limit value. The limit value is the number of concurrent TCP

connections that can be established by any given source.

You can configure DCA rules to limit the number of connections from:

• A specific IP address.

• Each IP address in an IP subnet or IP address range.

• An IP subnet or IP address range where all the IP addresses in the

subnet share the cumulative limit.

• Unknown IP addresses, where each unknown IP address has a

connection limit.

When the configured limit is reached, any additional connections to the

HP-UX IPFilter system are dropped. You can configure HP-UX IPFilter

to send a TCP reset when it drops these connection. See “return-rst:

Responding to Blocked TCP Packets” on page 37 for more information.

A set of commands helps collect data about the connections that are

being controlled. This data includes the source and destination IP

address, allocated number of connections, number of active connections,

and number of times the allocated quota of connections was exceeded.

These new commands can be found in:

• “The ipf Utility” on page 83.

— ipf -Q