Date: Thu, 1 Nov 2001 21:13:51 -0800 From: "Crist J. Clark" <cristjc@earthlink.net> To: Greg White <gregw-freebsd-security@greg.cex.ca> Cc: FreeBSD Security <freebsd-security@FreeBSD.ORG> Subject: Re: can I use keep-state for icmp rules? Message-ID: <20011101211351.E4360@blossom.cjclark.org> In-Reply-To: <20011031160928.H58605@greg.cex.ca>; from gregw-freebsd-security@greg.cex.ca on Wed, Oct 31, 2001 at 04:09:28PM -0800 References: <009c01c16017$dca045d0$0603a8c0@MIKELT> <20011029153954.B224@gohan.cjclark.org> <005501c1613f$dfb46520$0603a8c0@MIKELT> <20011030164253.C223@gohan.cjclark.org> <000901c1620f$51428530$2801010a@MIKELT> <20011031130817.A246@gohan.cjclark.org> <20011031144209.A89351@bluenugget.net> <20011031160928.H58605@greg.cex.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Oct 31, 2001 at 04:09:28PM -0800, Greg White wrote:
> On Wed Oct 10/31/01, 2001 at 02:42:09PM -0800, Jason DiCioccio wrote:
> > On Wed, Oct 31, 2001 at 01:08:17PM -0800, Crist J. Clark wrote:
> > [snip]
> > > Not sure if checking more "carefully" is an accurate statement, but
> > > IPFilter does only allow TCP packets that it "expects" back in. It
> > > does track sequence numbers which ipfw(8) does not track at all.
> > [snip]
> >
> > Now I'm curious. Will using "flags S" after keep state rules in ipfilter
> > degrade the quality of ipf's stateful inspection? I know it is recommended (at
> > least on the ipfilter webpage) to use flags S for tcp keep state rules if your
> > state table is filling up, if not in all cases. I'm just curious to know
> > whether using that 'flags S' will make the inspection work more like ipfw's.
> > If so, I might have to reconsider my use of it. :-)
>
> No, cannot see how it could. 'flags S' is for the outbound connection,
> not the packets coming back.
Not really. 'flags S' will match any packet with the SYN flag
set. This would include the initial _reply_ from a remote machine
which will have both the SYN and ACK flags set.
If you only want to catch an outgoing, initial SYN, you want
'flags S/SA'.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011101211351.E4360>