Does the coprocessor drop an address it is given? Measured, 2026-10-19¶
No - not on the XGS 3300's firmware (v22), and not on the XGS 136's either (measured
2026-10-20). The question came from the vendor's own design: its
command list has three commands between the QoS ones and the first IPsec one - DOS_SET_POLICY,
DOS_ADD_BLACKLIST_ENTRY and DOS_CLEAR_BLACKLIST, 27, 28 and 29 - with their structures in
dos_table.h: a policy (a packets-per-second ceiling, a type, whether a source over the ceiling is
blacklisted, and for how long) and an entry (a family, a type, an address, a duration). The XGS 136's
helper module was built with two more facts about them - an even type is a source and the next odd
one its destination; an entry lasts 30 seconds by default and 3,600 at most - and with an error code
for a full DoS table. If the coprocessor kept such a table, a block list could be enforced there, at
the port, before a frame reached the host.
The whole page, with how it was taken and what it does not show: Does the coprocessor drop an address it is given? Measured, 2026-10-19.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.