Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 25 Jul 2002 00:16:52 -0700
From:      Luigi Rizzo <>
Subject:   RFC: ipfw behaviour with non IPv4 packets
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
I would like your input here on the following issue.

The original "ipfw" would only see IPv4 packets, so given a rule
of the form
        <action> ip from <src> to <dst>
the "ip" protocol specifier effectively meant "any packet" (and
"any" is in fact a synonym for "ip").
IPFW2 also sees non-ipv4 packets, so in some cases (e.g. when no
other fields refer to IPv4 information, say "ip from any to any")
the rule can be ambiguous. As a matter of fact, the way I have
implemented it now is

        "ip" = "any" --> any packet, ipv4 or not 
You can have the same ambiguity when you specify a protocol like
"tcp" or "udp" -- do you want these rules to match only "*-over-ip4"
or ipv6 as well ?

I am a bit uncertain on what is the best path, but i believe a   
reasonable one is to assume

        "ip" = "any" --> any IP packet (v4 or v6) 

and similarly

        "proto" --> any packet of protocol "proto" over IP (v4 or v6)

Comments ?

  Luigi RIZZO,  . Dip. di Ing. dell'Informazione  . Universita` di Pisa
  TEL/FAX: +39-050-568.533/522     . via Diotisalvi 2, 56126 PISA (Italy)
  Mobile   +39-347-0373137

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>