From owner-freebsd-hackers  Sat Jun 29 11:20:31 2002
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F063237B40A
	for <freebsd-hackers@freebsd.org>; Sat, 29 Jun 2002 11:20:27 -0700 (PDT)
Received: from iguana.icir.org (iguana.icir.org [192.150.187.36])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A05A943E06
	for <freebsd-hackers@freebsd.org>; Sat, 29 Jun 2002 11:20:27 -0700 (PDT)
	(envelope-from rizzo@iguana.icir.org)
Received: (from rizzo@localhost)
	by iguana.icir.org (8.11.6/8.11.3) id g5TIKNp74030;
	Sat, 29 Jun 2002 11:20:23 -0700 (PDT)
	(envelope-from rizzo)
Date: Sat, 29 Jun 2002 11:20:23 -0700
From: Luigi Rizzo <rizzo@icir.org>
To: Joao Carlos <jcrr@ieee.org>
Cc: Nielsen <nielsen@memberwebs.com>,
	Terry Lambert <tlambert2@mindspring.com>,
	Ken Ebling <kebling@us-it.net>, freebsd-hackers@freebsd.org
Subject: Re: ipfw/dummynet suggestion
Message-ID: <20020629112023.C73787@iguana.icir.org>
References: <000801c21f1c$029cefe0$0201a8c0@Ken> <3D1D4EB3.9410011@mindspring.com> <20020629170251.65DDB43E13@mx1.FreeBSD.org> <20020629110237.A73787@iguana.icir.org> <001f01c21f99$3c363cc0$1e6eb0c8@pchome>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <001f01c21f99$3c363cc0$1e6eb0c8@pchome>; from jcrr@ieee.org on Sat, Jun 29, 2002 at 03:17:24PM -0300
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-hackers.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-hackers>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-hackers>
X-Loop: FreeBSD.ORG

On Sat, Jun 29, 2002 at 03:17:24PM -0300, Joao Carlos wrote:
> > several viruses do change the MAC address. The only real
> > security is to have one user per port and filter the ports.
> > Next step (but not as safe) is to wire down the arp table and only accept
> > things that are in there (will be easy to implement in the
> > new ipfw)
> 
> I think it would be easier to deny all mac address in the ipfw rules except
> by those that you know, right?

which must be recorded somewhere, and static entries in the
arp table are a nice place to look at.

	cheers
	luigi

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message