OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Fernando Gleiser (fgleisercactus.fi.uba.ar)
Date: Fri Jun 22 2001 - 20:23:30 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Fri, 22 Jun 2001, alexus wrote:

    > is it possible to disable using ipfw so people won't be able to traceroute
    > me?

    I don't know if it is posible with ipfw, but with ip filter you can add
    a rule to block any packets with ttl=1:

    block in log quick on xl0 ttl 1 proto ip all

    That will stop windows traceroute (icmp based) as well as unix traceroute
    (udp based).

    Unix traceroute uses udp packets with destination port > 33434, but this can
    be changed. As far as I know, the only way to stop traceroute is to drop
    any packet with ttl=1. This might block legitimate trafic, but I haven't
    seen any packet in the wild with ttl=1 wich was not a traceroute.

    Hope this helps.
                            Fer

    >
    >
    >
    > To Unsubscribe: send mail to majordomoFreeBSD.org
    > with "unsubscribe freebsd-security" in the body of the message
    >

    To Unsubscribe: send mail to majordomoFreeBSD.org
    with "unsubscribe freebsd-security" in the body of the message