Curby wrote:
Hi, this is slightly off-topic as it relates to IPFW2 in Mac OS X (as
of Tiger, 10.4.x).
I've read that when a FreeBSD machine running IPFW2 receives a
fragmented TCP packet (and let's say that the machine itself is the
intended destination), the packet is reassembled before it gets to
IPFW2, and IPFW2 sees a single TCP packet. Basically, the (first)
question is whether this is the case in OS X.
I don't believe that happens in FreeBSD.. where did you hear that?
*adds looking at the code to 10,000 item list of things to do*
Next, and especially if reassembly occurs before the firewall, what is
the point of the frag flag in a rule body, e.g.:
add 04010 deny log all from any to any frag in
Question 2 in a nutshell: what's the point of "frag" if frags are
already being reassembled? Is this meant to reject incoming frags
that aren't reassembled by the kernel (i.e. crap traffic)? I'm
actually using the exact rule above in my laptop firewall
configuration, and the only time I've seen it triggering is at a
conference's wifi network, where other clients would be sending
multicast frags to 224.0.0.251. (If that's crap traffic, why would it
be rampant at that conference?) Thanks!
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
