Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 19 Dec 2001 19:49:03 +0300
From:      Yar Tikhiy <yar@FreeBSD.ORG>
To:        Maxim Konovalov <maxim@macomnet.ru>
Cc:        net@FreeBSD.ORG, hackers@FreeBSD.ORG
Subject:   Re: Processing IP options reveals IPSTEALH router
Message-ID:  <20011219194903.D21732@comp.chem.msu.su>
In-Reply-To: <20011219190533.W57795-100000@news1.macomnet.ru>; from maxim@macomnet.ru on Wed, Dec 19, 2001 at 07:23:55PM %2B0300
References:  <20011219181929.A20425@comp.chem.msu.su> <20011219190533.W57795-100000@news1.macomnet.ru>

next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Dec 19, 2001 at 07:23:55PM +0300, Maxim Konovalov wrote:
> 
> > I ran into an absolutely clear, but year-old PR pointing out that
> > a router in the IPSTEALTH mode will reveal itself when processing
> > IP options: kern/23123.
> >
> > The fix proposed seems clean and right to me: don't do IP options
> > at all when in the IPSTEALTH mode.  Does anyone have objections?
> > If no, I'll commit the fix.
> 
> First of all we should decide what IPSTEALTH is for. Is it just a
> Ruslan's net.inet.ip.decttl or it should really stealth the fact of
> the routing? If the latter how do we behave in source routing case?

Are there any reasons for a router not to decrement IP TTL besides
trying to stay invisible to a third party?

As for source routing, I believe a stealthy router should just drop
such packets as though it were a host.  Of course, source-routed
packets destined for the router itself should be accepted.

-- 
Yar

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011219194903.D21732>