Date: Wed, 4 Jul 2001 09:12:24 -0400 (EDT) From: Ralph Huntington <rjh@mohawk.net> To: cjclark@alum.mit.edu Cc: freebsd-security@FreeBSD.ORG Subject: Re: firewall question Message-ID: <Pine.BSF.4.21.0107040911530.46560-100000@mohegan.mohawk.net> In-Reply-To: <20010704002534.D1476@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Thank you vwery much. I should have found that myself. -=r=- On Wed, 4 Jul 2001, Crist J. Clark wrote: > On Tue, Jul 03, 2001 at 10:45:27AM -0400, Ralph Huntington wrote: > > > > ipfw: -1 Refuse TCP W.X.Y.Z:0 A.B.C.D:0 in via fxp0 > > ipfw: -1 Refuse TCP S.T.U.V:0 A.B.C.D:0 in via fxp0 > > FINE POINTS > o There is one kind of packet that the firewall will always discard, > that is a TCP packet's fragment with a fragment offset of one. This > is a valid packet, but it only has one use, to try to circumvent > firewalls. When logging is enabled, these packets are reported as > being dropped by rule -1. > > -- > Crist J. Clark cjclark@alum.mit.edu > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0107040911530.46560-100000>