Date: Tue, 15 Sep 1998 21:09:35 +0000 (GMT) From: Terry Lambert <tlambert@primenet.com> To: sthaug@nethelp.no Cc: tlambert@primenet.com, hackers@FreeBSD.ORG, questions@FreeBSD.ORG Subject: Re: problem using 3 x znyx314 cards for 12 de ethernets Message-ID: <199809152109.OAA25292@usr09.primenet.com> In-Reply-To: <10256.905814797@verdi.nethelp.no> from "sthaug@nethelp.no" at Sep 15, 98 01:13:17 am
next in thread | previous in thread | raw e-mail | index | archive | help
> Also, since the FreeBSD TCP/IP stack currently doesn't implement IPv6, > I find it hard to use this as a very strong argument. Both the WIDE IPv6 and the INRIA IPv6 run under FreeBSD. > My conclusion is that we probably need separate sysctl variables for > "multicast echo" and "broadcast echo", with the former defaulting to > on, and the latter to off. Yes, I volunteer to do this if there is > any interest. I think it should default to "on", since that is historical behaviour, and because I've had more than one MIS problem that came down to not being able to identify the hardware address of a misconfigured machine because the !@#!@$! thing would not reply to broadcast ping, and didn't support any services that you could telnet to to get it in the arp table to look there. At this point, lack of a broadcast ping degrades to a cube-to-cube search for the offending Microsoft box. If FreeBSD also fails to reply to perfectly valid broadcasts, well, then it becomes a cube-to-cube search for the offending Microsoft *or* FreeBSD box (bletch!). If you are worried about DOS attacks, and you are too stupid to set up your firewall correctly, I have little sympathy, since if nothing else, they could hijack your NFS connections (which I presume you were also too dumb to firewall: stupid is as stupid does, after all), and then sysctl the things back on themselves. In other words, either your network is secure by design, or it's broken by design, and there is no "happy medium". > > Certainly, you should be able to turn it off, but the correct place > > to block DOS broadcast ping attacks is your firewall. > > I agree that this is the best place for it - but I'd also like FreeBSD > systems to be secure against smurf attacks out of the box, even if the > router/firewall/whatever lets IP broadcast through (and translates it > to link-level broadcast). And what about NFS hijack, SMB hijack, source routing, IP spoofing, etc.? A firewall is a requirement for a secure network; that's all there is to it. Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809152109.OAA25292>