From owner-freebsd-security Thu Nov 1 21:16:24 2001 Delivered-To: freebsd-security@freebsd.org Received: from raven.mail.pas.earthlink.net (raven.mail.pas.earthlink.net [207.217.120.39]) by hub.freebsd.org (Postfix) with ESMTP id 5EDE737B403 for ; Thu, 1 Nov 2001 21:16:21 -0800 (PST) Received: from dialup-209.247.138.228.dial1.sanjose1.level3.net ([209.247.138.228] helo=blossom.cjclark.org) by raven.mail.pas.earthlink.net with esmtp (Exim 3.33 #1) id 15zWga-0000Q7-00; Thu, 01 Nov 2001 21:16:14 -0800 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id fA25DpZ06544; Thu, 1 Nov 2001 21:13:51 -0800 (PST) (envelope-from cjc) Date: Thu, 1 Nov 2001 21:13:51 -0800 From: "Crist J. Clark" To: Greg White Cc: FreeBSD Security Subject: Re: can I use keep-state for icmp rules? Message-ID: <20011101211351.E4360@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <009c01c16017$dca045d0$0603a8c0@MIKELT> <20011029153954.B224@gohan.cjclark.org> <005501c1613f$dfb46520$0603a8c0@MIKELT> <20011030164253.C223@gohan.cjclark.org> <000901c1620f$51428530$2801010a@MIKELT> <20011031130817.A246@gohan.cjclark.org> <20011031144209.A89351@bluenugget.net> <20011031160928.H58605@greg.cex.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20011031160928.H58605@greg.cex.ca>; from gregw-freebsd-security@greg.cex.ca on Wed, Oct 31, 2001 at 04:09:28PM -0800 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, Oct 31, 2001 at 04:09:28PM -0800, Greg White wrote: > On Wed Oct 10/31/01, 2001 at 02:42:09PM -0800, Jason DiCioccio wrote: > > On Wed, Oct 31, 2001 at 01:08:17PM -0800, Crist J. Clark wrote: > > [snip] > > > Not sure if checking more "carefully" is an accurate statement, but > > > IPFilter does only allow TCP packets that it "expects" back in. It > > > does track sequence numbers which ipfw(8) does not track at all. > > [snip] > > > > Now I'm curious. Will using "flags S" after keep state rules in ipfilter > > degrade the quality of ipf's stateful inspection? I know it is recommended (at > > least on the ipfilter webpage) to use flags S for tcp keep state rules if your > > state table is filling up, if not in all cases. I'm just curious to know > > whether using that 'flags S' will make the inspection work more like ipfw's. > > If so, I might have to reconsider my use of it. :-) > > No, cannot see how it could. 'flags S' is for the outbound connection, > not the packets coming back. Not really. 'flags S' will match any packet with the SYN flag set. This would include the initial _reply_ from a remote machine which will have both the SYN and ACK flags set. If you only want to catch an outgoing, initial SYN, you want 'flags S/SA'. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message