Date: Thu, 6 Dec 2001 23:55:38 +1100 (Australia/NSW) From: Darren Reed <avalon@cairo.anu.edu.au> To: rasputin@submonkey.net Cc: security@FreeBSD.ORG Subject: Re: ipf and log_in_vain Message-ID: <200112061255.fB6CtcKO013756@cairo.anu.edu.au> In-Reply-To: <20011206125224.A72358@shikima.mine.nu> from "Rasputin" at Dec 06, 2001 12:52:24 PM
next in thread | previous in thread | raw e-mail | index | archive | help
In some mail from Rasputin, sie said: [...] > If that's the case, I'm assuming that the reason they manage to pass through > is because keep-state directives in ipf.conf are still treating packets > returned from (e.g.) DNS queries as part of an existing session. Sounds quite plausible. > Is this right, and if so, how do I drop the time an idle session is > marked as active > (the default is on the order of days, IIRC)? There is a UDP specific timeout - fr_udptimeout - accessible through sysctl. Darren To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200112061255.fB6CtcKO013756>