Date: 30 Oct 2001 17:42:15 +0100 From: Dag-Erling Smorgrav <des@ofug.org> To: Ralph Huntington <rjh@mohawk.net> Cc: Michael Scheidell <scheidell@fdma.com>, <freebsd-security@FreeBSD.ORG> Subject: Re: can I use keep-state for icmp rules? Message-ID: <xzpn129yt94.fsf@flood.ping.uio.no> In-Reply-To: <20011030102625.U73979-100000@mohegan.mohawk.net> References: <20011030102625.U73979-100000@mohegan.mohawk.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Ralph Huntington <rjh@mohawk.net> writes: > ipfw does not really track the state, but ipfilter (ipf) does. My > understanding (please correct me if I'm wrong!) is that ipfw could be > fooled by incoming packets spoofing the state of the connection, whereas > ipf keeps its own table and relies on that instead of the incoming > packets' assertions. -=r=- Not true. Both ipf and ipfw can do both stateless and stateful inspection. DES -- Dag-Erling Smorgrav - des@ofug.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?xzpn129yt94.fsf>