Date: Tue, 15 Jun 1999 10:07:01 -0600 (MDT) From: "David G. Andersen" <danderse@cs.utah.edu> To: Dag-Erling Smorgrav <des@flood.ping.uio.no> Cc: Juergen Nickelsen <ni@tellique.de>, sporkl@ix.netcom.com, freebsd-security@FreeBSD.ORG Subject: Re: firewalls Message-ID: <14182.31150.906360.944872@torrey.cs.utah.edu> In-Reply-To: Dag-Erling Smorgrav's message of , June 15 1999 <xzpk8t5e9i3.fsf@flood.ping.uio.no> References: <Pine.BSF.4.05.9906121112550.6023-100000@pigstuy.penguinpowered.com> <376669B1.F7E6A746@tellique.de> <xzpk8t5e9i3.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
Lo and Behold, Dag-Erling Smorgrav said:
> > 13 Timestamp [RFC792]
> > 14 Timestamp Reply [RFC792]
> > 17 Address Mask Request [RFC950]
> > 18 Address Mask Reply [RFC950]
>
> None of these are useful.
And, in fact, can potentially leak information you don't want
leaked; many hosts will incorrectly respond to address mask requests,
which you can use in some situations to perform better network
mapping, etc., of a target site. Block 'em! :)
(I include timestamp in there because sometimes it's really nice to
see which machines are the "black sheep" of the network; e.g. those
which aren't time-synched in a sea of otherwise conformant machines.
They're often not up to date on security issues either).
-Dave
--
work: danderse@cs.utah.edu me: angio@pobox.com
University of Utah http://www.angio.net/
Computer Science - Flux Research Group "What's footnote FIVE?"
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?14182.31150.906360.944872>