From owner-freebsd-security Thu Nov 5 01:24:12 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id BAA10826 for freebsd-security-outgoing; Thu, 5 Nov 1998 01:24:12 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from mail.webspan.net (mail.webspan.net [206.154.70.7]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id BAA10811 for ; Thu, 5 Nov 1998 01:24:09 -0800 (PST) (envelope-from opsys@mail.webspan.net) Received: from orion.webspan.net (orion.webspan.net [206.154.70.5]) by mail.webspan.net (WEBSPAN/970608) with SMTP id EAA12255 for ; Thu, 5 Nov 1998 04:24:02 -0500 (EST) Date: Thu, 5 Nov 1998 04:24:00 -0500 (EST) From: Open Systems Networking X-Sender: opsys@orion.webspan.net To: freebsd-security@FreeBSD.ORG Subject: Amazing wonder packet Part 2. In-Reply-To: <19981104112352.B4776@mcs.net> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Ok someone sent me this so I thought I would run it by the list i'll quote the message here: "seeing how /etc/rc.firewall is a shell script, it is reasonable to assume that most ruleset will include small raceable sections where some packets that should be denied will not be. I kludged as bellow: put a '$fwcmd add 1 deny all from any to any' as the first rule and moved the flush command to one line above it. put a '$fwcmd delete 1' right after my 65534 deny all. This should cut the available time for races down substantially. I've seen packets hit the temporary rule but have never seen a magic packet that made it too the last." What do you guys think about this as a possible solution/hack. Short of tearing up ipfw which I don't have the time to do can anyone see this having more negative actions rather than positive ones? Im not really sure what else one could do. Chris -- "You both seem to be ignoring the fact that the networking market is driven by so-called 'IT professionals' these days, most of whom can't tell the difference between an ARP and a carp." --Wes Peters ===================================| Open Systems FreeBSD Consulting. FreeBSD 3.0 is available now! | Phone: (402)573-9124 / ICQ # 20016186 -----------------------------------| 3335 N. 103 Plaza, Omaha, NE 68134 FreeBSD: The power to serve! | E-Mail: opsys@open-systems.net http://www.freebsd.org | Consulting, Network Engineering, Security ===================================| http://open-systems.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message