Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 4 May 2014 00:53:54 +1000 (EST)
From:      Ian Smith <smithi@nimnet.asn.au>
To:        Garrett Wollman <wollman@bimajority.org>
Cc:        freebsd-security@freebsd.org
Subject:   Re: FreeBSD Security Advisory FreeBSD-SA-14:08.tcp
Message-ID:  <20140504003835.J11699@sola.nimnet.asn.au>
In-Reply-To: <21348.32212.390793.959943@hergotha.csail.mit.edu>
References:  <3867.1399059743@server1.tristatelogic.com> <5363FA70.9040100@delphij.net> <20140503133437.R11699@sola.nimnet.asn.au> <21348.32212.390793.959943@hergotha.csail.mit.edu>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 3 May 2014 01:25:40 -0400, Garrett Wollman wrote:
 > <<On Sat, 3 May 2014 13:53:44 +1000 (EST), Ian Smith <smithi@nimnet.asn.au> said:
 > 
 > > I've always allowed frags, as per the example rulesets in rc.firewall.  
 > > I only recall seeing them on DNS responses from zen.spamhaus.org, where 
 > > I see plenty of these after a resetlog before the logging limit kicks 
 > > in.  I doubt I'd be getting rid of ~90% of incoming spam without; eg:
 > 
 > Blocking inbound fragments will definitely screw you when you try to
 > use DNSsec.

Thanks to you and Darren; more grist for mending the Handbook ipfw page, 
likely why some people have been perhaps ill-advisedly dropping frags.

cheers, Ian



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140504003835.J11699>