Out of curiosity, which of the following causes the least load on a system?

A) - dropping offending hosts with iptables and -DROP
B) - dropping with entries in hosts.deny?

I would initially think dropping with iptables would cause less stress as it drops the packets at a lower, earlier level, but would like some insight from someone with more inside knowledge than I do..

Thanks!

-Y1

I'd have thought you were right that using iptables created less load.

Refusal of a connection by iptables is done when the first SYN packet is received at the firewall and no further packets related to that connection attempt are processed. Using hosts.allow and hosts.deny files requires that the connection is made and the files need to be parsed to see if the IP address is allowed to connect.

However, I've never checked to see just how efficient iptables is at dropping packets compared to allowing the packets and having tcp wrappers do the work. In other words I'm guessing too - sorry about that