From owner-freebsd-security@FreeBSD.ORG  Thu Feb 19 14:31:01 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D2C1016A4CE
	for <freebsd-security@freebsd.org>;
	Thu, 19 Feb 2004 14:31:01 -0800 (PST)
Received: from web12608.mail.yahoo.com (web12608.mail.yahoo.com
	[216.136.173.231])
	by mx1.FreeBSD.org (Postfix) with SMTP id BA12F43D2F
	for <freebsd-security@freebsd.org>;
	Thu, 19 Feb 2004 14:31:01 -0800 (PST)
	(envelope-from bj93542@yahoo.com)
Message-ID: <20040219223101.37571.qmail@web12608.mail.yahoo.com>
Received: from [128.226.68.47] by web12608.mail.yahoo.com via HTTP;
	Thu, 19 Feb 2004 14:31:01 PST
Date: Thu, 19 Feb 2004 14:31:01 -0800 (PST)
From: Dorin H <bj93542@yahoo.com>
To: Bruce M Simpson <bms@spc.org>
In-Reply-To: <20040219211411.GB3612@saboteur.dek.spc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: freebsd-security@freebsd.org
Subject: Re: traffic normalizer for ipfw?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Feb 2004 22:31:02 -0000

--- Bruce M Simpson <bms@spc.org> wrote:
> On Thu, Feb 19, 2004 at 01:02:16PM -0800, Dorin H
> wrote:
> >   Is there some way to configure ipfw to do
> traffic
> > normalizing ("scrubbing", as in ipf for OpenBSD)?
<snip>

> We're looking at bringing pf into the tree.

Is it the same thing as the port pf_freebsd-2.03
(/usr/port/security/pf)?  I am mainly familiar  with
ipfw on FBSD. 

> 
> If you're talking about traffic shaping, have a look
> at dummynet which is
> already there.
> 

Ok, let me clarify.  I am thinking at the ability to
modify the packet headers on the fly, to mitigate some
of the IDS evasion techniques, and possibly eliminate
other network recons.
I know that pf is able to modify things like IP
minimum TTL, reset Don't Fragment, and so on and I was
wondering if there is a way to do it with ipfw or some
additional plug.
Thank you,
/Dorin.

__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools