Date: Thu, 19 Feb 2004 14:31:01 -0800 (PST) From: Dorin H <bj93542@yahoo.com> To: Bruce M Simpson <bms@spc.org> Cc: freebsd-security@freebsd.org Subject: Re: traffic normalizer for ipfw? Message-ID: <20040219223101.37571.qmail@web12608.mail.yahoo.com> In-Reply-To: <20040219211411.GB3612@saboteur.dek.spc.org>
index | next in thread | previous in thread | raw e-mail
--- Bruce M Simpson <bms@spc.org> wrote:
> On Thu, Feb 19, 2004 at 01:02:16PM -0800, Dorin H
> wrote:
> > Is there some way to configure ipfw to do
> traffic
> > normalizing ("scrubbing", as in ipf for OpenBSD)?
<snip>
> We're looking at bringing pf into the tree.
Is it the same thing as the port pf_freebsd-2.03
(/usr/port/security/pf)? I am mainly familiar with
ipfw on FBSD.
>
> If you're talking about traffic shaping, have a look
> at dummynet which is
> already there.
>
Ok, let me clarify. I am thinking at the ability to
modify the packet headers on the fly, to mitigate some
of the IDS evasion techniques, and possibly eliminate
other network recons.
I know that pf is able to modify things like IP
minimum TTL, reset Don't Fragment, and so on and I was
wondering if there is a way to do it with ipfw or some
additional plug.
Thank you,
/Dorin.
__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040219223101.37571.qmail>