Date: 30 Oct 2001 17:59:58 +0100 From: Dag-Erling Smorgrav <des@ofug.org> To: Ralph Huntington <rjh@mohawk.net> Cc: Michael Scheidell <scheidell@fdma.com>, <freebsd-security@FreeBSD.ORG> Subject: Re: can I use keep-state for icmp rules? Message-ID: <xzpvggxcbch.fsf@flood.ping.uio.no> In-Reply-To: <20011030115012.Y73979-100000@mohegan.mohawk.net> References: <20011030115012.Y73979-100000@mohegan.mohawk.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Ralph Huntington <rjh@mohawk.net> writes: > Can you be more specific? They both do stateful inspections, yes, but ipfw > inspects the incoming packets' headers for the state information, whereas > ipf inspects its own state table to associate incoming packets with a > particular connection. The behaviour you describe is stateless inspection. Ipfw has had stateful inspection (the keep-state keyword) since February 2000. DES -- Dag-Erling Smorgrav - des@ofug.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?xzpvggxcbch.fsf>