From owner-freebsd-security Thu Dec 6 4:55:46 2001 Delivered-To: freebsd-security@freebsd.org Received: from cairo.anu.edu.au (cairo.anu.edu.au [150.203.224.11]) by hub.freebsd.org (Postfix) with ESMTP id F1B3E37B417 for ; Thu, 6 Dec 2001 04:55:42 -0800 (PST) Received: from cairo.anu.edu.au (localhost [127.0.0.1]) by cairo.anu.edu.au (8.12.0/8.12.0) with ESMTP id fB6Ctd6V013758; Thu, 6 Dec 2001 23:55:40 +1100 (EST) Received: (from avalon@localhost) by cairo.anu.edu.au (8.12.0/8.12.0.Beta16) id fB6CtcKO013756; Thu, 6 Dec 2001 23:55:38 +1100 (EST) From: Darren Reed Message-Id: <200112061255.fB6CtcKO013756@cairo.anu.edu.au> Subject: Re: ipf and log_in_vain To: rasputin@submonkey.net Date: Thu, 6 Dec 2001 23:55:38 +1100 (Australia/NSW) Cc: security@FreeBSD.ORG In-Reply-To: <20011206125224.A72358@shikima.mine.nu> from "Rasputin" at Dec 06, 2001 12:52:24 PM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org In some mail from Rasputin, sie said: [...] > If that's the case, I'm assuming that the reason they manage to pass through > is because keep-state directives in ipf.conf are still treating packets > returned from (e.g.) DNS queries as part of an existing session. Sounds quite plausible. > Is this right, and if so, how do I drop the time an idle session is > marked as active > (the default is on the order of days, IIRC)? There is a UDP specific timeout - fr_udptimeout - accessible through sysctl. Darren To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message