Date: Fri, 5 Dec 2003 10:58:39 +0000 From: Jez Hancock <jez.hancock@munk.nu> To: FreeBSD Questions List <freebsd-questions@freebsd.org> Subject: Re: ipfilter traffic blocking and tcpdump snort etc Message-ID: <20031205105839.GC65445@users.munk.nu> In-Reply-To: <20031205.103353.985d01b49b9f3980.10.0.3.9@bugsgrief.net> References: <20031205002412.GA37507@users.munk.nu> <20031205.103353.985d01b49b9f3980.10.0.3.9@bugsgrief.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Horio,
Cheers for reply.
On Fri, Dec 05, 2003 at 07:33:49PM +0900, horio shoichi wrote:
> On Fri, 5 Dec 2003 00:24:12 +0000
> Jez Hancock <jez.hancock@munk.nu> wrote:
> > Hi,
> >
> > I've blocked a dozen or so addresses using ipfilter:
> >
> > block in quick on fxp0 from 208.186.60.116 to any
> > block in quick on fxp0 from 216.230.149.11 to any
> >
> > etc
> >
> > but I still see a lot of traffic those hosts in trafshow, snort and
> > other packet capturing utils. Why is this?
>
> You are probably seeing the supposedly blocked packets on the "outside" of
> network. Observe them on "inside", i.e., on the interface not fxp0.
Not sure what you mean here, what command would you issue via tcpdump or
snort to do what you suggest?
> What you are seeing are packets ipfilter is just about to handle.
Right - it's just I would have thought that ipfilter handled packets
before they reached any traffic dumping utils. I see what you're
getting at. Presumably snort for example uses the bpf driver via pcap(?) to
capture network traffic...
actually reading bpf(4) clears things up a little:
Associated with each open instance of a bpf file is a user-settable
packet filter. Whenever a packet is received by an interface, all file
descriptors listening on that interface apply their filter. Each
descriptor that accepts the packet receives its own copy.
> > Is there any alternative method of blocking access from certain hosts
> > so that this traffic is not 'seen' by higher level /userland apps?
> I don't understand your second question. Are you thinking about tcp wrapper,
> reset feature of snort, etc ?
Let me rephrase that one :P I meant is there a method - for example
such as adding some kind of routing via arp - so that packets are
dropped on the floor even quicker than they would be via the firewall
method?
--
Jez Hancock
- System Administrator / PHP Developer
http://munk.nu/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031205105839.GC65445>