From owner-freebsd-security  Tue Jun 15  9:10:31 1999
Delivered-To: freebsd-security@freebsd.org
Received: from wrath.cs.utah.edu (wrath.cs.utah.edu [155.99.198.100])
	by hub.freebsd.org (Postfix) with ESMTP id 64ED9155DF
	for <freebsd-security@FreeBSD.ORG>; Tue, 15 Jun 1999 09:10:28 -0700 (PDT)
	(envelope-from danderse@cs.utah.edu)
Received: from torrey.cs.utah.edu (torrey.cs.utah.edu [155.99.212.91])
	by wrath.cs.utah.edu (8.8.8/8.8.8) with ESMTP id KAA05852;
	Tue, 15 Jun 1999 10:07:01 -0600 (MDT)
Received: (from danderse@localhost)
	by torrey.cs.utah.edu (8.9.3/8.9.1) id KAA01671;
	Tue, 15 Jun 1999 10:07:01 -0600 (MDT)
	(envelope-from danderse@cs.utah.edu)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Date: Tue, 15 Jun 1999 10:07:01 -0600 (MDT)
From: "David G. Andersen" <danderse@cs.utah.edu>
To: Dag-Erling Smorgrav <des@flood.ping.uio.no>
Cc: Juergen Nickelsen <ni@tellique.de>, sporkl@ix.netcom.com,
	freebsd-security@FreeBSD.ORG
Subject: Re: firewalls
In-Reply-To: Dag-Erling Smorgrav's message of , June 15 1999 <xzpk8t5e9i3.fsf@flood.ping.uio.no>
References: <Pine.BSF.4.05.9906121112550.6023-100000@pigstuy.penguinpowered.com>
	<376669B1.F7E6A746@tellique.de>
	<xzpk8t5e9i3.fsf@flood.ping.uio.no>
X-Mailer: VM 6.43 under 20.4 "Emerald" XEmacs  Lucid
Message-ID: <14182.31150.906360.944872@torrey.cs.utah.edu>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Lo and Behold, Dag-Erling Smorgrav said:

> >  13     Timestamp                                [RFC792]
> >  14     Timestamp Reply                          [RFC792]
> >  17     Address Mask Request                     [RFC950]
> >  18     Address Mask Reply                       [RFC950]
> 
> None of these are useful.

   And, in fact, can potentially leak information you don't want
leaked; many hosts will incorrectly respond to address mask requests,
which you can use in some situations to perform better network
mapping, etc., of a target site.  Block 'em! :)

  (I include timestamp in there because sometimes it's really nice to
see which machines are the "black sheep" of the network; e.g. those
which aren't time-synched in a sea of otherwise conformant machines.
They're often not up to date on security issues either).

   -Dave

-- 
work: danderse@cs.utah.edu                     me:  angio@pobox.com
      University of Utah                            http://www.angio.net/
      Computer Science - Flux Research Group   "What's footnote FIVE?"


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message