Date: Thu, 2 Oct 2003 23:46:11 -0400 From: Haesu <haesu@towardex.com> To: freebsd-isp@freebsd.org Subject: uRPF on FreeBSD Message-ID: <20031003034611.GA59149@scylla.towardex.com>
next in thread | raw e-mail | index | archive | help
Is there any reverse-path verification feature in FreeBSD kernel? reverse-path verification as in uRPF (unicast reverse path filtering) widely used for anti-ip-spoofing. If it is supported, then does FreeBSD's uPRF implementation also allow loose and strict check like on Cisco? Also... one last question that goes with this.. If uRPF feature is in FreeBSD, and if I route a prefix to ds0 (discard/null interface "pseudo-device disc"), and a packet originates with source of a route that is forwarded to ds0, would that invoke a verification drop? On Cisco, if an origin packet has a source ip that's routed to Null0 or does not exist in routing table (this is under loose check), then it would cause a verification drop.. Thanks! -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu@towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031003034611.GA59149>