From owner-freebsd-security Wed Nov 4 05:28:18 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id FAA22617 for freebsd-security-outgoing; Wed, 4 Nov 1998 05:28:18 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from mail.webspan.net (mail.webspan.net [206.154.70.7]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id FAA22611 for ; Wed, 4 Nov 1998 05:28:16 -0800 (PST) (envelope-from opsys@mail.webspan.net) Received: from orion.webspan.net (orion.webspan.net [206.154.70.5]) by mail.webspan.net (WEBSPAN/970608) with SMTP id IAA16942 for ; Wed, 4 Nov 1998 08:28:09 -0500 (EST) Date: Wed, 4 Nov 1998 08:28:08 -0500 (EST) From: Open Systems Networking X-Sender: opsys@orion.webspan.net To: freebsd-security@FreeBSD.ORG Subject: Amazing wonder packet sneaks by deny all rule? Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org It's really late/early this morning and I was just checking the rule set on a clients machine I just built. When I saw this: 65534 195 14104 deny log ip from any to any 65535 1 76 deny ip from any to any Now maybe it's my lack of sleep but how did that amazing wonder packet on rule 65535 sneak by 65534 :-) A fluke? A 1 in a million chance? A posessed packet? This isn't exactly the kind of thing that instills confidence in ones choice of firewall software :-) It's ipfw BTW if you cant tell from the syntax, not ipfilter. I have NEVER seen this happen before, so im guessing it's just a freak accident. But it is curious nonetheless. Chris -- "You both seem to be ignoring the fact that the networking market is driven by so-called 'IT professionals' these days, most of whom can't tell the difference between an ARP and a carp." --Wes Peters ===================================| Open Systems FreeBSD Consulting. FreeBSD 3.0 is available now! | Phone: (402)573-9124 / ICQ # 20016186 -----------------------------------| 3335 N. 103 Plaza, Omaha, NE 68134 FreeBSD: The power to serve! | E-Mail: opsys@open-systems.net http://www.freebsd.org | Consulting, Network Engineering, Security ===================================| http://open-systems.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message