Berkeley CSUA MOTD:Entry 17614
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/24 [General] UID:1000 Activity:popular
5/24    

2000/2/25-26 [Computer/SW/Unix, Computer/Networking] UID:17614 Activity:kinda low
2/24    Security Questions. I was reading about some strategies for defeating
        DDOS on http://www.sans.org/ddos_roadmap.htm One of thier points
        was:

        * Unless an organization is aware of a legitimate need to
          support broadcast or multicast traffic within its
          environment, the forwarding of directed broadcasts should be
          turned off.

        I'm using my linux box as a router, and I want to know if this
        means that I should do something like the following:

        ifconfig eth0 -broadcast -multicast

        Another point was that RPC services should be disabled on
        border systems. My understanding was that a border system
        shouldn't server files via NFS, but mounting was okay. If I
        need to mount directories, should I be firewalling the RPC
        port?
        \_ -broadcast means something other than 'forwarding directed
           broadcasts'.  In fact if you actually turn that off you may
           break important broadcast based protocols like ARP. If you're
           on a linux box you really want to do something more like:
           echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
           -ERic
           \_ Thanks. Do you know if this works with 2.0 kernels or is
              it just 2.2 kernels? Also, I'm assuming that -multicast
              is okay.
              \_ Doesn't look like 2.0 kernels have the option.  I'm assuming
                 you dont need multicast for things like MBONE so yeah
                 just turn it off too. -ERic
                 \_ I'm not using MBONE at home. I only have 384/128 ADSL,
                    so its just not fast enough. I guess I will have to look
                    at the 2.0 kernel compile options to get something similar
                    to ignore broadcasts feature.
                    \_ you'd probably do a lot better to just set up a
                       lot of ipfw rules to block out any traffic you dont
                       really need. -ERic
2025/05/24 [General] UID:1000 Activity:popular
5/24    

You may also be interested in these entries...
2005/1/14-17 [Computer/Networking] UID:35720 Activity:nil
1/14    I am trying to use DI-604 as a firewall but it comes with zero doc.
        about ipfw rules.  The firewall rules has only one port specification.
        Does it refer to the wan or lan?  Are the rules stateful or static?
	...
2004/12/2-4 [Computer/Networking] UID:35157 Activity:moderate
12/2    I used the "ShieldUp" website to probe my Mac and it shows that port 0
        and 1 are replying to outside query to say they are closed instead of
        just playing deaf like the other lower ports do.  I did not single
        out port 0 and 1 in the ipfw rules I use.  What rules should I use to
        close this loophole?
        \_ First off, don't use random pages like that, as Steve Gibson is
	...
2004/5/9-10 [Computer/Networking, Computer/SW/OS/FreeBSD] UID:30119 Activity:moderate
5/9     Sometimes I need to upload large files on my 1500k/192k aDSL. This
        totally kills my Internet usability. Is there any uber cool BSD/Darwin
        tool that will let me throttle a particular socket? If I could just
        limit my FTP to something like 128k... tnx
        \_ rsync --bwlimit=KBPS ...
        \_ man ipfw
	...
2004/2/5 [Computer/SW/Security, Computer/Networking, Computer/SW/WWW/Browsers] UID:12105 Activity:nil
2/4     Since ipfw rules does not care which program is making the outbound
        access, how do I block, say all outgoing traffic except that generated
        by ssh and mozilla?
        \_ That's not really what ipfw does.  Block all outbound traffic
           destined for ports other than 80, 443 and 22.
           \_ Okay, is there a way to block based on program name in FreeBSD?
	...
2003/9/4 [Computer/SW/OS/FreeBSD] UID:10072 Activity:nil
9/4     Does anyone know whether there's a way to use interface names
        in an ipfilter/ipnat configuration, as opposed to an interface's IP
        address?  -John
        \_ With ipfw there was, and I think ipf has a way to.  Must dig some.
           ... with pf (openbsd) it is very simple.
           --scotsman
	...
2002/2/21-22 [Computer/HW/CPU] UID:23938 Activity:high
2/21    reposting my question.  Is it possible to filter gige traffic
        with freebsd on x86?  Can the fastest pentium out there do that?
        I'm talking about running ipfw or ACLs.  Please do not turn this
        question into a troll on linux vs freebsd.  Thanks.
        \_ Processor speed is definitely not your problem.  I think you may
           run into problems where gige would overwhelm the PCI bus.  Not
	...
2001/12/11-12 [Computer/Networking] UID:23208 Activity:moderate
12/07   I'm a big lazy wimp who has been spoiled by the nice easy
        GUI that comes with Firewall one.  Anyone know a nice
        easy gui frontend for managing netfilter/ipfw rules?
        \_ vi
        \_http://sourceforge.net/softwaremap/trove_list.php?form_cat \
          =10&discrim=151
	...
2001/10/19-20 [Computer/Networking, Computer/SW/OS/FreeBSD] UID:22779 Activity:very high
10/19   Home Gateway recommendations wanted. I am thinking of getting
        a NetGear RP114. I use Pacbell DSL (dhcp not static ip). Any
        pros/cons to using this model? Is there a better one within
        the same price range? (approx $120). thanks.
        \_ I use a Linksys for around $98.  It has firewall, IPSEC
           support, 10/100 support.  No "parental control" though.
	...
2001/2/26-27 [Computer/Networking] UID:20703 Activity:very high
2/26    Is it possible to use ipfw in *BSD to let users do FTP gets but not
        FTP puts?  I'm being asked to let people get stuff from the internet
        but not let them send anything out.  If ipfw can't do it, how about a
        commercial firewall like Cisco PIX or Checkpoint?  Thanks.
           \_ Checkpoint can't. I don't know about PIX, it might have
              tcp payload inspection.
	...
2000/4/27-29 [Computer/Networking, Computer/SW/Unix] UID:18124 Activity:high 72%like:18122
4/26    I have one IP address on my DSL line.  I have three computers
        on my LAN.  I want to be able to telnet into any of these from
        an outside IP address.  How do I do this?  [Question re-phrased]
        [Does anyone know of a product that can route more than one domain
        on one ip?  I know this is possible with virtual hosting.  Im trying
        to set up three computers I can telnet to on my DSL line, which only
	...
Cache (178 bytes)
www.sans.org/ddos_roadmap.htm
The page you are looking for has moved, you will now be redirected to the new page. Please update your Bookmark. If the page does not refresh, click the link below. References 1.