Date: Mon, 25 Jun 2001 09:37:31 +0300 From: Peter Pentchev <roam@orbitel.bg> To: Simon Rakovec <simon@inforta.com> Cc: freebsd-security@freebsd.org Subject: Re: disable traceroute to my host Message-ID: <20010625093731.A934@ringworld.oblivion.bg> In-Reply-To: <3B36267B.5B5FDBE@inforta.com>; from simon@inforta.com on Sun, Jun 24, 2001 at 07:42:19PM %2B0200 References: <006a01c0fb6b$2d64d830$9865fea9@book> <3B36267B.5B5FDBE@inforta.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jun 24, 2001 at 07:42:19PM +0200, Simon Rakovec wrote: > Try this: > > ipfw add deny udp from any 32769-65535 to <your-host> 33434-33523 As Karsten noted in a followup, this is not proper network practice. There might be a LOT of things listening on those UDP ports, including ephemeral outgoing UDP connections. As many other people noted, this does not stop Windows traceroute, which goes via ICMP. As the traceroute(8) manpage notes, this does not stop people who know how to use the traceroute '-p port' option to select a starting port != 32768. As Dag-Erling Smoerdgrav noted, in general it is impossible to disable a person determined to traceroute you, and in practice, there is no need to. G'luck, Peter PS. How was that now... one source: plagiarism, two sources: comparative study, three sources: an academic thesis.. I did even better than that! ;) -- Thit sentence is not self-referential because "thit" is not a word. > alexus wrote: > > > > is it possible to disable using ipfw so people won't be able to traceroute > > me? > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010625093731.A934>