Date: Sat, 26 Sep 1998 18:09:33 +0000 From: Niall Smart <rotel@indigo.ie> To: Adam McDougall <mcdougall@ameritech.net>, security@FreeBSD.ORG Subject: Re: Changing 3-way handshakes to prevent port scans Message-ID: <199809261709.SAA07885@indigo.ie> In-Reply-To: <360CFD95.1A0B1ED2@ameritech.net>; Adam McDougall <mcdougall@ameritech.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sep 26, 10:43am, Adam McDougall wrote: } Subject: Changing 3-way handshakes to prevent port scans > I know someone who has linux patches to alter 3-way handshakes so a > 'strobe' portscan returns no open ports, yet normal tcp communication > seems unhindered, does anyone have any patches for FreeBSD to do the > same? If the patches for linux might help I could attempt to dig them > up. Thanks This just isn't possible. A variety of portscanners exploit particular implementation bugs or features to determine if a port is being listened on, but strobe simply sends a plain old SYN segment and waits for a SYN|ACK, changing that would break TCP. Send me on the patches anyway and I'll see what I think they actually do. You can use ipfw to block port scans from particular hosts. Niall -- Niall Smart, rotel@indigo.ie. Amaze your friends and annoy your enemies: echo '#define if(x) if (!(x))' >> /usr/include/stdio.h To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809261709.SAA07885>