Date: Wed, 15 Jan 2003 11:18:45 -0800 (PST) From: Julian Elischer <julian@elischer.org> To: Josh Brooks <user@mail.econolodgetulsa.com> Cc: freebsd-hackers@freebsd.org Subject: Re: simple tcp question (syn, no mss) Message-ID: <Pine.BSF.4.21.0301151118120.91512-100000@InterJet.elischer.org> In-Reply-To: <20030115002040.T39623-100000@mail.econolodgetulsa.com>
next in thread | previous in thread | raw e-mail | index | archive | help
why don't you put in a rule to catche them and count them. then after a day or two you can go see how many there were.. On Wed, 15 Jan 2003, Josh Brooks wrote: > > Will I ever see a _legitimate_ packet in the wild that is a SYN, and has > no MSS ? > > > If the answer is no, then is this a good rule to block those: > > ipfw add 00001 deny tcp from any to any tcpflags syn tcpoptions !mss > > Or is this one better: > > ipfw add 00002 deny tcp from any to any setup tcpoptions !mss > > ----- > > I am simply trying to place a rule which blocks those packets and does not > deny _any_ legitimate traffic (I don't consider nmapping to be legit for > this discussion) - this is all provided that I am correct that there are > no _legitimate_ packets in the wild that have a SYN and no MSS. > > thanks. > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-hackers" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0301151118120.91512-100000>