OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: ipfw log accounting
From: Crist J. Clark (cjccc942873-a.ewndsr1.nj.home.com)
Date: Tue Feb 29 2000 - 07:51:45 CST

On Tue, Feb 29, 2000 at 12:14:44AM -0800, Rodney W. Grimes wrote:
> > In message <20000228215904.B31743cc942873-a.ewndsr1.nj.home.com>,
> > "Crist J. Cl
> > ark" writes:
> > > On Tue, Feb 29, 2000 at 01:46:53AM +0300, Lev Serebryakov wrote:
> > > [snip]
> > > > And one more question:
> > > > How could I write rule, which skip all broadcast traffic? My
> > > > computer is on big provider's net, and here is more than one
> > > > broadcast address (many subnets on one wire)...
> > >
> > > Never tried this and haven't glanced at the source to see if it has a
> > > chance of working, but _theoretically_ is there a reason that,
> > >
> > > deny ip from 0.0.0.255:0.0.0.255 to any
> > >
> > > A "reversed" netmask won't work?
> >
> > Been there done that. This works using either IPFW or IP Filter,
> > however you'll want to code it as the following, as the destination is
> > the broadcast address:
>
> Actually you need to be a bit selective, your host is going to have
> a real hard time doing arp's if you block all broadcast packets. Make
> sure you have a directly connected network specific ``allow'' of broadcast
> destinations.

The above only would block broadcast _IP_ packets (and as was pointed
out in the reply with the lost attribution, you would want to block
the broadcast _destination_ not source). ARP is not an IP
protocol so they are not effected by the rule. In fact IIRC, since ARP
packets do not even have source or desitnation IPs (they use the MAC
addresses and the MAC broadcast, ff:ff:ff:ff:ff:ff), the only ipfw
rule that can catch them is '<action> all from any to any'. 

-- 
Crist J. Clark                           cjclarkhome.com

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message