Jesper Wallin <[EMAIL PROTECTED]> writes:
> Also, I wonder why the TCP_DROP_SYNFIN option isn't checked in pf_norm.c?

Because there's no reason for it to be.

> Sure, it might be bad/good/whatever dropping packets with SYN/FIN,
> but if you decide to do it and add the TCP_DROP_SYNFIN option, then
> it should drop them even if you use pf, ipf or ipfw..

No.  If you want to drop SYN+FIN frames that pass *through* you (as
opposed to those sent *to* you), it's easy enough to add a firewall
rule.

The TCP_DROP_SYNFIN option should be removed; it has long outlived its
original purpose (which was to prevent nmap identification of IRC
servers which didn't run ipfw for performance reasons, back in the 3.0
days)

DES
-- 
Dag-Erling Smørgrav - [EMAIL PROTECTED]

_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to