undefined | Better HN

0 pointsgumby4y ago0 comments

These stateful devices have to look at all the traffic and maintain connection data for every transaction. That takes space and time and is bounded in volume.

0 comments

2 comments · 1 top-level

tsimionescu4y ago· 1 in thread

The same is true of firewalls, so I don't get your point. Even in IPv6, your router-level firewall will need to know if a packet with dst_port=31536 is part of an existing connection or not, which means it has to monitor all traffic and maintain connection data for every transaction, no different from a NAT device.

gumbyOP4y ago

What is the point of a perimiter firewall in the modern Internet? Those TV and lightbulbs are attack vectors inside the firewall. And there are (and will be more) plenty of devices that bridge the cellular networks and the LAN.

You need a defense at depth, not a crunchy perimeter with a squishy inside.

j / k navigate · click thread line to collapse