From owner-freebsd-net Thu Nov 8 15:45:12 2001 Delivered-To: freebsd-net@freebsd.org Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26]) by hub.freebsd.org (Postfix) with ESMTP id 7F9D737B41C for ; Thu, 8 Nov 2001 15:45:09 -0800 (PST) Received: from arch20m.dellroad.org (arch20m.dellroad.org [10.1.1.20]) by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id PAA24975; Thu, 8 Nov 2001 15:38:11 -0800 (PST) Received: (from archie@localhost) by arch20m.dellroad.org (8.11.6/8.11.6) id fA8NcBK41060; Thu, 8 Nov 2001 15:38:11 -0800 (PST) (envelope-from archie) From: Archie Cobbs Message-Id: <200111082338.fA8NcBK41060@arch20m.dellroad.org> Subject: Re: Fixing ipfw(8)'s 'tee' In-Reply-To: <20011107154601.A301@blossom.cjclark.org> "from Crist J. Clark at Nov 7, 2001 03:46:01 pm" To: cjclark@alum.mit.edu Date: Thu, 8 Nov 2001 15:38:11 -0800 (PST) Cc: Luigi Rizzo , freebsd-net@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL82 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Crist J. Clark writes: > The issue may be that you wish to make a decision on the packet in > later rules. For example, someone might wish to 'tee' all traffic to > and from a certain machine to some unspecified traffic monitoring > program listening on the divert socket. However, all of the traffic > too and from that IP address may or may not be allowed by the security > policy. With 'tee' as it exists, one cannot catch _all_ of the traffic > (whether or not allowed by policy) and still apply policy. Yes, this is how 'tee' should work. It was really hard to do at the time for some reason that I can't recall... I think because the interface between ip_input.c and ip_fw.c doesn't handle one packet splitting into two packets like that.. but maybe things have gotten better since then. -Archie __________________________________________________________________________ Archie Cobbs * Packet Design * http://www.packetdesign.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message