From owner-freebsd-security  Tue Aug 21  4:18:21 2001
Delivered-To: freebsd-security@freebsd.org
Received: from brea.mc.mpls.visi.com (brea.mc.mpls.visi.com [208.42.156.100])
	by hub.freebsd.org (Postfix) with ESMTP id 9D5DC37B40F
	for <freebsd-security@freebsd.org>; Tue, 21 Aug 2001 04:18:16 -0700 (PDT)
	(envelope-from hawkeyd@visi.com)
Received: from sheol.localdomain (hawkeyd-fw.dsl.visi.com [208.42.101.193])
	by brea.mc.mpls.visi.com (Postfix) with ESMTP id D38AC2DDB33
	for <freebsd-security@freebsd.org>; Tue, 21 Aug 2001 06:18:15 -0500 (CDT)
Received: (from hawkeyd@localhost)
	by sheol.localdomain (8.11.1/8.11.1) id f7LBIFR24442
	for freebsd-security@freebsd.org; Tue, 21 Aug 2001 06:18:15 -0500 (CDT)
	(envelope-from hawkeyd)
Date: Tue, 21 Aug 2001 06:12:25 -0500
From: D J Hawkey Jr <hawkeyd@visi.com>
To: freebsd-security@freebsd.com
Subject: Re: ipf / ipfw Which to use?
Message-ID: <20010821061225.A24329@sheol.localdomain>
Reply-To: hawkeyd@visi.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On 21 Aug 2001 11:01:40 +0000, roam@ringlet.net wrote:
> 
> On Tue, Aug 21, 2001 at 05:55:44AM -0500, D J Hawkey Jr wrote:
> > 
> > On 21 Aug 2001 09:42:18 +0000, wkb@freebie.xs4all.nl wrote:
> > > 
> > > Largely it is a matter of taste. Ipfilter is multiplatform, ipfw is
> > > FreeBSD-only. You can also combine the 2 (e.g. if you want IPfilter and
> > > dummynet at the same time).
> > 
> > It's also a matter of efficiency; ipfilter does it all in the kernel, as
> > opposed to the packets having to go to userland and back for 'ipfw' to
> > play with them.
> 
> ipfw does not process packets in userland.
> 
> natd, as used with ipfw, processes NAT'd (diverted) packets in userland.
> ipnat, as used with ipfilter, processes NAT'd (diverted) packets in
> the kernel.

I stand corrected. Thanks.

> G'luck,
> Peter

You too,
Dave

-- 
  ______________________                         ______________________
  \__________________   \    D. J. HAWKEY JR.   /   __________________/
     \________________/\     hawkeyd@visi.com    /\________________/
                      http://www.visi.com/~hawkeyd/


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message