Date: Sun, 3 Sep 2000 02:37:59 -0400 From: Bill Fumerola <billf@chimesnet.com> To: Dragos Ruiu <dr@kyx.net> Cc: Nicolas <list@rachinsky.de>, freebsd-security@FreeBSD.ORG Subject: Re: ipfw and fragments Message-ID: <20000903023759.O33771@jade.chc-chimes.com> In-Reply-To: <00090217534118.20066@smp.kyx.net>; from dr@kyx.net on Sat, Sep 02, 2000 at 05:50:02PM -0700 References: <007a01c01457$3b9eff80$e4aa603e@gottt> <20000901170437.J33771@jade.chc-chimes.com> <00090217534118.20066@smp.kyx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 02, 2000 at 05:50:02PM -0700, Dragos Ruiu wrote:
> > > Is there a way to make ipfw to reassemble fragmented ip packets before passing them through the rules?
> >
> > No. The relevant bits are only in the first packet.
> >
> It could be made to reassemble them,
> but it would incurr a performance hit.
What do you gain? Nothing that I can think that ipfw currently
tests for is in the non-initial fragment.
If we tested for length of data or something like that (on
my list), it might become relevant, but not really. ipfw
examines data on a packet-by-packet level.
--
Bill Fumerola - Network Architect, BOFH / Chimes, Inc.
billf@chimesnet.com / billf@FreeBSD.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000903023759.O33771>