From owner-freebsd-security  Mon Oct  1 10:36:53 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id C5F5537B401
	for <freebsd-security@FreeBSD.ORG>; Mon,  1 Oct 2001 10:34:01 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id LAA08152;
	Mon, 1 Oct 2001 11:33:40 -0600 (MDT)
Message-Id: <4.3.2.7.2.20011001113137.046d1600@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Mon, 01 Oct 2001 11:33:21 -0600
To: Laurent Fabre <fabre@matranet.com>, freebsd-security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD
In-Reply-To: <200110010917.LAA03131@malraux.matranet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 03:21 AM 10/1/2001, Laurent Fabre wrote:
  
>Ok what about two modes, one will acquire spare IP on the network, and the other won't. Instead rules will be loaded from a config file (and yep of course we need hooks, maybe the DHCPd log output could be sufficient but i didn't look at it yet).

This would be virtually the same as using divert(4) sockets or BPF.
The nice thing about divert(4) sockets is that IPFW can pre-filter
packets so that they only receive relevant traffic. You can
eliminate a lot of redundant effort.

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message