From owner-freebsd-security Sat Sep 26 10:16:35 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id KAA26079 for freebsd-security-outgoing; Sat, 26 Sep 1998 10:16:35 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from indigo.ie (ts01-007.dublin.indigo.ie [194.125.134.17]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id KAA26071 for ; Sat, 26 Sep 1998 10:16:30 -0700 (PDT) (envelope-from rotel@indigo.ie) Received: (from nsmart@localhost) by indigo.ie (8.8.8/8.8.7) id SAA07885; Sat, 26 Sep 1998 18:09:35 +0100 (IST) (envelope-from rotel@indigo.ie) From: Niall Smart Message-Id: <199809261709.SAA07885@indigo.ie> Date: Sat, 26 Sep 1998 18:09:33 +0000 In-Reply-To: <360CFD95.1A0B1ED2@ameritech.net>; Adam McDougall Reply-To: rotel@indigo.ie X-Files: The truth is out there X-Mailer: Mail User's Shell (7.2.6 beta(3) 11/17/96) To: Adam McDougall , security@FreeBSD.ORG Subject: Re: Changing 3-way handshakes to prevent port scans Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sep 26, 10:43am, Adam McDougall wrote: } Subject: Changing 3-way handshakes to prevent port scans > I know someone who has linux patches to alter 3-way handshakes so a > 'strobe' portscan returns no open ports, yet normal tcp communication > seems unhindered, does anyone have any patches for FreeBSD to do the > same? If the patches for linux might help I could attempt to dig them > up. Thanks This just isn't possible. A variety of portscanners exploit particular implementation bugs or features to determine if a port is being listened on, but strobe simply sends a plain old SYN segment and waits for a SYN|ACK, changing that would break TCP. Send me on the patches anyway and I'll see what I think they actually do. You can use ipfw to block port scans from particular hosts. Niall -- Niall Smart, rotel@indigo.ie. Amaze your friends and annoy your enemies: echo '#define if(x) if (!(x))' >> /usr/include/stdio.h To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message