Date: Wed, 10 Jul 2002 20:56:39 +0300 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: "Ramsey G. Brenner" <rgbrenner@myrealbox.com> Cc: Laurence Brockman <laurence@fluxinc.com>, freebsd-security@FreeBSD.org Subject: Re: hiding OS name Message-ID: <20020710175639.GE1118@hades.hell.gr> In-Reply-To: <200207080834.53431.rgbrenner@myrealbox.com> References: <006601c22627$a9199000$21020a0a@mti.itb.ac.id> <3D294723.7022CD07@pantherdragon.org> <001201c22689$6049a790$140115ac@BCDOMAIN01.COM> <200207080834.53431.rgbrenner@myrealbox.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2002-07-08 08:34 +0000, Ramsey G. Brenner wrote: > >From /sys/i386/conf/LINT > # > # TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This > # prevents nmap et al. from identifying the TCP/IP stack, but breaks support > # for RFC1644 extensions and is not recommended for web servers. > # > options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN > > Also dont forget to add > tcp_drop_synfin="YES" > to /etc/rc.conf That's one thing you can do to counter some of the methods used by tools like nmap to detect the OS type and version. You should not forger to read the comments in LINT about this specific option. Pay careful attention to the cases that it mentions this option should not be used. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020710175639.GE1118>