Date: Wed, 4 Jul 2001 00:25:34 -0700 From: "Crist J. Clark" <cristjc@earthlink.net> To: Ralph Huntington <rjh@mohawk.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: firewall question Message-ID: <20010704002534.D1476@blossom.cjclark.org> In-Reply-To: <Pine.BSF.4.21.0107031039010.18482-100000@mohegan.mohawk.net>; from rjh@mohawk.net on Tue, Jul 03, 2001 at 10:45:27AM -0400 References: <20010702192720.P17514@speedy.gsinet> <Pine.BSF.4.21.0107031039010.18482-100000@mohegan.mohawk.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jul 03, 2001 at 10:45:27AM -0400, Ralph Huntington wrote:
> The dmesg command shows a lot of these:
>
> ipfw: -1 Refuse TCP W.X.Y.Z:0 A.B.C.D:0 in via fxp0
> ipfw: -1 Refuse TCP S.T.U.V:0 A.B.C.D:0 in via fxp0
>
> (The uppercase letters represent the ip addresses)
>
> There are no rules in ipfw blocking packets from addresses W.X.Y.Z or
> S.T.U.V to host A.B.C.D. Can someone tell me what is going on here?
FINE POINTS
o There is one kind of packet that the firewall will always discard,
that is a TCP packet's fragment with a fragment offset of one. This
is a valid packet, but it only has one use, to try to circumvent
firewalls. When logging is enabled, these packets are reported as
being dropped by rule -1.
--
Crist J. Clark cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010704002534.D1476>