From owner-freebsd-security  Mon Jun 25 12:39:36 2001
Delivered-To: freebsd-security@freebsd.org
Received: from db.nexgen.com (db.nexgen.com [64.81.208.78])
	by hub.freebsd.org (Postfix) with SMTP id 3349D37B405
	for <freebsd-security@FreeBSD.ORG>; Mon, 25 Jun 2001 12:39:30 -0700 (PDT)
	(envelope-from ml@db.nexgen.com)
Received: (qmail 13941 invoked from network); 25 Jun 2001 19:40:18 -0000
Received: from localhost.nexgen.com (HELO book) (root@127.0.0.1)
  by localhost.nexgen.com with SMTP; 25 Jun 2001 19:40:18 -0000
Message-ID: <00fd01c0fdae$95c16430$9865fea9@book>
From: "alexus" <ml@db.nexgen.com>
To: "Fernando Gleiser" <fgleiser@cactus.fi.uba.ar>
Cc: <freebsd-security@FreeBSD.ORG>
References: <20010622221554.K5703-100000@cactus.fi.uba.ar>
Subject: Re: disable traceroute to my host
Date: Mon, 25 Jun 2001 15:39:44 -0400
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

only for incoming? or for outgoing as well?

----- Original Message -----
From: "Fernando Gleiser" <fgleiser@cactus.fi.uba.ar>
To: "alexus" <ml@db.nexgen.com>
Cc: <freebsd-security@FreeBSD.ORG>
Sent: Friday, June 22, 2001 9:23 PM
Subject: Re: disable traceroute to my host


> On Fri, 22 Jun 2001, alexus wrote:
>
> > is it possible to disable using ipfw so people won't be able to
traceroute
> > me?
>
> I don't know if it is posible with ipfw, but with ip filter you can add
> a rule to block any packets with ttl=1:
>
> block in log quick on xl0 ttl 1 proto ip all
>
> That will stop windows traceroute (icmp based) as well as unix traceroute
> (udp based).
>
> Unix traceroute uses udp packets with destination port > 33434, but this
can
> be changed. As far as I know, the only way to stop traceroute is to drop
> any packet with ttl=1. This might block legitimate trafic, but I haven't
> seen any packet in the wild with ttl=1 wich was not a traceroute.
>
>
> Hope this helps.
> Fer
>
>
>
> >
> >
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-security" in the body of the message
> >
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message