From owner-freebsd-pf@FreeBSD.ORG  Thu Aug  4 17:40:11 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: pf@freebsd.org
Delivered-To: freebsd-pf@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A000416A41F
	for <pf@freebsd.org>; Thu,  4 Aug 2005 17:40:11 +0000 (GMT)
	(envelope-from gpt@tirloni.org)
Received: from srv-03.bs2.com.br (srv-03.bs2.com.br [200.203.183.32])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 439BB43D48
	for <pf@freebsd.org>; Thu,  4 Aug 2005 17:40:08 +0000 (GMT)
	(envelope-from gpt@tirloni.org)
Received: from localhost (localhost.bs2.com.br [127.0.0.1])
	by srv-03.bs2.com.br (Postfix) with ESMTP id E8C2A4B8C4;
	Thu,  4 Aug 2005 14:40:40 -0300 (BRT)
Received: from [127.0.0.1] (unknown [201.14.1.190])
	by srv-03.bs2.com.br (Postfix) with ESMTP id B09814B786;
	Thu,  4 Aug 2005 14:40:39 -0300 (BRT)
Message-ID: <42F28B79.1030202@tirloni.org>
Date: Thu, 04 Aug 2005 14:41:13 -0700
From: "Giovanni P. Tirloni" <gpt@tirloni.org>
User-Agent: Mozilla Thunderbird 1.0.6 (Windows/20050716)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: BB <brent.bolin@gmail.com>
References: <787dcac2050803142433b8d084@mail.gmail.com>
In-Reply-To: <787dcac2050803142433b8d084@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: pf@freebsd.org
Subject: Re: Can pf dynamicly close connections
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Aug 2005 17:40:11 -0000

BB wrote:
> If a host is sending packets on ports that aren't even open can it 
> temporarily close all connections to this host.

  I don't think this a task pf itself should do but you can implement 
something to monitor connections attemps on closed ports and then 
inspect the pf's state table (pfctl -s state) and remove it (pfctl -k).

  Do you want something like PortSentry ? Someone could spoof those 
attempts and create a DoS on something you don't want to block.

--
Giovanni P. Tirloni