From owner-freebsd-questions@FreeBSD.ORG Fri Dec 5 18:37:00 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4C45D16A4CE for ; Fri, 5 Dec 2003 18:37:00 -0800 (PST) Received: from dns12.mail.yahoo.co.jp (dns12.mail.yahoo.co.jp [210.81.151.145]) by mx1.FreeBSD.org (Postfix) with SMTP id 3E3C643FD7 for ; Fri, 5 Dec 2003 18:36:58 -0800 (PST) (envelope-from ayakokiko@ybb.ne.jp) Received: from unknown (HELO gorgon.near.this) (219.11.234.11 with poptime) by dns12.mail.yahoo.co.jp with SMTP; 6 Dec 2003 02:36:56 -0000 X-Apparently-From: Received: from ghost.near.this (ghost.near.this [10.0.3.9]) by gorgon.near.this (Postfix) with ESMTP id 7E49E7F81 for ; Sat, 6 Dec 2003 11:36:51 +0900 (JST) Received: by ghost.near.this (Postfix, from userid 100) id 2CE0B1934B; Sat, 6 Dec 2003 11:36:48 +0900 (JST) Date: Sat, 6 Dec 2003 11:36:28 +0900 From: horio shoichi To: freebsd-questions@freebsd.org In-Reply-To: <20031205105839.GC65445@users.munk.nu> References: <20031205002412.GA37507@users.munk.nu> <20031205.103353.985d01b49b9f3980.10.0.3.9@bugsgrief.net> <20031205105839.GC65445@users.munk.nu> X-Mailer: Sylpheed version 0.9.6claws (GTK+ 1.2.10; i386-portbld-freebsd4.8) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-Id: <20031206.023648.5283e90dba6730f9.10.0.3.9@bugsgrief.net> Subject: Re: ipfilter traffic blocking and tcpdump snort etc X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Dec 2003 02:37:00 -0000 On Fri, 5 Dec 2003 10:58:39 +0000 Jez Hancock wrote: > Hi Horio, > > Cheers for reply. > > On Fri, Dec 05, 2003 at 07:33:49PM +0900, horio shoichi wrote: > > On Fri, 5 Dec 2003 00:24:12 +0000 > > Jez Hancock wrote: > > > Hi, > > > > > > I've blocked a dozen or so addresses using ipfilter: > > > > > > block in quick on fxp0 from 208.186.60.116 to any > > > block in quick on fxp0 from 216.230.149.11 to any > > > > > > etc > > > > > > but I still see a lot of traffic those hosts in trafshow, snort and > > > other packet capturing utils. Why is this? > > > > You are probably seeing the supposedly blocked packets on the "outside" of > > network. Observe them on "inside", i.e., on the interface not fxp0. > Not sure what you mean here, what command would you issue via tcpdump or > snort to do what you suggest? Um, that's my bad assumption ! I thought your box is a filtering router, and has at least two interfaces. > > > What you are seeing are packets ipfilter is just about to handle. > Right - it's just I would have thought that ipfilter handled packets > before they reached any traffic dumping utils. I see what you're > getting at. Presumably snort for example uses the bpf driver via pcap(?) to > capture network traffic... > > actually reading bpf(4) clears things up a little: > > Associated with each open instance of a bpf file is a user-settable > packet filter. Whenever a packet is received by an interface, all file > descriptors listening on that interface apply their filter. Each > descriptor that accepts the packet receives its own copy. > The "log" keyword on blocking rules would have helped... > > > Is there any alternative method of blocking access from certain hosts > > > so that this traffic is not 'seen' by higher level /userland apps? > > I don't understand your second question. Are you thinking about tcp wrapper, > > reset feature of snort, etc ? > Let me rephrase that one :P I meant is there a method - for example > such as adding some kind of routing via arp - so that packets are > dropped on the floor even quicker than they would be via the firewall > method? In my observation, packet filters are the quickest since blocked packets die in ip_input(), below which is where ethernet interrupt handlers are laid out. horio shoichi > > -- > Jez Hancock > - System Administrator / PHP Developer > > http://munk.nu/ > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" >