Date: Sun, 4 May 2014 00:53:54 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Garrett Wollman <wollman@bimajority.org> Cc: freebsd-security@freebsd.org Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:08.tcp Message-ID: <20140504003835.J11699@sola.nimnet.asn.au> In-Reply-To: <21348.32212.390793.959943@hergotha.csail.mit.edu> References: <3867.1399059743@server1.tristatelogic.com> <5363FA70.9040100@delphij.net> <20140503133437.R11699@sola.nimnet.asn.au> <21348.32212.390793.959943@hergotha.csail.mit.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 3 May 2014 01:25:40 -0400, Garrett Wollman wrote: > <<On Sat, 3 May 2014 13:53:44 +1000 (EST), Ian Smith <smithi@nimnet.asn.au> said: > > > I've always allowed frags, as per the example rulesets in rc.firewall. > > I only recall seeing them on DNS responses from zen.spamhaus.org, where > > I see plenty of these after a resetlog before the logging limit kicks > > in. I doubt I'd be getting rid of ~90% of incoming spam without; eg: > > Blocking inbound fragments will definitely screw you when you try to > use DNSsec. Thanks to you and Darren; more grist for mending the Handbook ipfw page, likely why some people have been perhaps ill-advisedly dropping frags. cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140504003835.J11699>