From owner-freebsd-isp Mon Jun 25 12:50:39 2001 Delivered-To: freebsd-isp@freebsd.org Received: from db.nexgen.com (db.nexgen.com [64.81.208.78]) by hub.freebsd.org (Postfix) with SMTP id 8C44537B407 for ; Mon, 25 Jun 2001 12:50:31 -0700 (PDT) (envelope-from ml@db.nexgen.com) Received: (qmail 14140 invoked from network); 25 Jun 2001 19:51:19 -0000 Received: from localhost.nexgen.com (HELO book) (root@127.0.0.1) by localhost.nexgen.com with SMTP; 25 Jun 2001 19:51:19 -0000 Message-ID: <017a01c0fdb0$1ff51240$9865fea9@book> From: "alexus" To: "Igor Podlesny" Cc: , References: <006a01c0fb6b$2d64d830$9865fea9@book> <13760134158.20010623111308@morning.ru> Subject: Re: disable traceroute to my host Date: Mon, 25 Jun 2001 15:50:45 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org thanks a lot for this whole explanation, i appreciate everyone on the list for taking time to explain how basics works.. i'm trying to read books, manuals, internet for all those things but not everything makes sense, although when real person explains it helps me a lot better thanks everyone ----- Original Message ----- From: "Igor Podlesny" To: "alexus" Cc: ; Sent: Saturday, June 23, 2001 12:13 AM Subject: Re: disable traceroute to my host > > > is it possible to disable using ipfw so people won't be able to traceroute > > me? > > Yes, of course. > > You should know how do traceroute-like utilities work. > > The knowledge can be easily extracted from a lot of sources, for e.g. > from Internet, cause you seem to be connected ;) but, it also should > be mentioned that man pages coming with FreeBSD (I guess as well as > with other *NIX-likes OSes) also describe the algo. > > so man traceroute says, that it uses udp ports starting with 33434 and > goes up with every new hop. but this could be easily changed with -p > option. Besides, windows' tracert works using icmp proto, so the > decision isn't here. It lies in what does the box do when answering to > them. It does send 'time exceeded in-transit' icmp message cause TTL > value is set too low to let the packet jump forward. So it is the > answer -- you should disallow it with your ipfw. for e.g. using such > syntax: > > deny icmp from any to any icmptype 11 > > (yeah, you should carefully think about whether or not to use ANY > cause if you're box is a gateway other people will notice your > cutting-edge knowledge cause it will hide not only your host ;) > > This is not the end, alas. unix traceroute will wait for port unreach > icmp so after meeting, it stops and displays the end-point of your > trace. Windows' tracert will wait for normal icmp-echo-reply for the > same purpose. So if you also wish to hide the end point, you need to > disallow this also. I bet you can figure out the way how by yourself, > now. > > P.S. there are also other ways (even more elegant) of doing that in > practice... they called 'stealth routing' and can be implemented via > FreeBSD kernel mechanism (sysctl + built-in kernel support) or with > ipf (ipfilter) > > read the man pages, man, they are freely available... > > -- > Igor mailto:poige@morning.ru > http://poige.nm.ru > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message