From owner-freebsd-questions@FreeBSD.ORG Fri Dec 5 02:58:41 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6CB5616A4CE for ; Fri, 5 Dec 2003 02:58:41 -0800 (PST) Received: from munk.nu (mail.munk.nu [213.152.51.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3EB9443FDF for ; Fri, 5 Dec 2003 02:58:40 -0800 (PST) (envelope-from munk@munk.nu) Received: from munk by munk.nu with local (Exim 4.24; FreeBSD) id 1ASDfT-000HvZ-2O for freebsd-questions@freebsd.org; Fri, 05 Dec 2003 10:58:39 +0000 Date: Fri, 5 Dec 2003 10:58:39 +0000 From: Jez Hancock To: FreeBSD Questions List Message-ID: <20031205105839.GC65445@users.munk.nu> Mail-Followup-To: FreeBSD Questions List References: <20031205002412.GA37507@users.munk.nu> <20031205.103353.985d01b49b9f3980.10.0.3.9@bugsgrief.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20031205.103353.985d01b49b9f3980.10.0.3.9@bugsgrief.net> User-Agent: Mutt/1.4.1i Sender: User Munk Subject: Re: ipfilter traffic blocking and tcpdump snort etc X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Dec 2003 10:58:41 -0000 Hi Horio, Cheers for reply. On Fri, Dec 05, 2003 at 07:33:49PM +0900, horio shoichi wrote: > On Fri, 5 Dec 2003 00:24:12 +0000 > Jez Hancock wrote: > > Hi, > > > > I've blocked a dozen or so addresses using ipfilter: > > > > block in quick on fxp0 from 208.186.60.116 to any > > block in quick on fxp0 from 216.230.149.11 to any > > > > etc > > > > but I still see a lot of traffic those hosts in trafshow, snort and > > other packet capturing utils. Why is this? > > You are probably seeing the supposedly blocked packets on the "outside" of > network. Observe them on "inside", i.e., on the interface not fxp0. Not sure what you mean here, what command would you issue via tcpdump or snort to do what you suggest? > What you are seeing are packets ipfilter is just about to handle. Right - it's just I would have thought that ipfilter handled packets before they reached any traffic dumping utils. I see what you're getting at. Presumably snort for example uses the bpf driver via pcap(?) to capture network traffic... actually reading bpf(4) clears things up a little: Associated with each open instance of a bpf file is a user-settable packet filter. Whenever a packet is received by an interface, all file descriptors listening on that interface apply their filter. Each descriptor that accepts the packet receives its own copy. > > Is there any alternative method of blocking access from certain hosts > > so that this traffic is not 'seen' by higher level /userland apps? > I don't understand your second question. Are you thinking about tcp wrapper, > reset feature of snort, etc ? Let me rephrase that one :P I meant is there a method - for example such as adding some kind of routing via arp - so that packets are dropped on the floor even quicker than they would be via the firewall method? -- Jez Hancock - System Administrator / PHP Developer http://munk.nu/