On Tue, Apr 04, 2000 at 08:50:37AM +1000, Jamie Honan wrote:
> > closes the connection if not. Optus merely detect the connection
> > establishment.
>
> Rather like rattling a stranger's front door to see if it is
> locked? A little impolite, I would think.
It's more than a little impolite. When I detect such scans here at work,
I complain to the offenders ISP. Such activity is often (but not always)
a violation of the ISP's AUP. If it's not acceptable for users to do it,
it's not acceptable for network providers to do it either, even if the
network providers are using it to detect other violations of the AUP.
The end does *not* justify the means.
I understand Optus's concern, but I don't like their way of going about
it. Merely listening on a port does not make a server, at least, not one
that's accessible from the outside world.
> (Surely optus' concern is bandwidth overutilisation. Wouldn't
> it be more useful for them to look at extravagent upstream traffic
> patterns and then investigate?)
Precisely. However, this requires more work on their part, not just to
set it up, but in ongoing maintenance. Portscanning is far simpler, but
with a well designed firewall, totally useless. Once you know where their
scans originate, it's trivial to block the appropriate packets from those
addresses.
> One question. Say you didn't want to have two network cards,
> but you still wanted to have masquerade for your local
> net.
>
> Has anyone tried to use ip aliasing on the eth0 interface
> to achieve this? I guess this might be tricky with dhcp.
I don't think ip aliasing would be at all difficult, even with dhcp. At
worst I'd expect that you may have to shutdown your local net while you
bring up your link to Optus, then restart it after the connection is
established. Note that I haven't tried anything like this, so I could be
wrong.
Far more of a concern would be the fact that all your other machines are
then connected to your external interface, so they're all potentially
vulnerable to an attack. It may cost slightly more to buy a second
network card, but it's far more secure to isolate your local network
behind a firewall.
Then there's the issue of packets appearing at Optus's network with an RFC
1918 address. These addresses should *never* be sent outside your local
network (nor should they be accepted if you receive one from outside, an
easy modification of the firewall rules I posted yesterday). From RFC
1918:
Because private addresses have no global meaning ... packets with
private source or destination addresses should not be forwarded across
[inter-enterprise] links.
Connecting your local net to the external interface violates this rule,
because you won't be able to stop these packets appearing at Optus's end
of the link. Optus *should* discard them, but that's not the issue. You
*must not* send them out.
So, spend $40 and buy a second network card. Much less trouble in the
long run.
Cheers,
John
--
whois [EMAIL PROTECTED]
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
