Jesper Wallin <[EMAIL PROTECTED]> writes: > Also, I wonder why the TCP_DROP_SYNFIN option isn't checked in pf_norm.c?
Because there's no reason for it to be. > Sure, it might be bad/good/whatever dropping packets with SYN/FIN, > but if you decide to do it and add the TCP_DROP_SYNFIN option, then > it should drop them even if you use pf, ipf or ipfw.. No. If you want to drop SYN+FIN frames that pass *through* you (as opposed to those sent *to* you), it's easy enough to add a firewall rule. The TCP_DROP_SYNFIN option should be removed; it has long outlived its original purpose (which was to prevent nmap identification of IRC servers which didn't run ipfw for performance reasons, back in the 3.0 days) DES -- Dag-Erling Smørgrav - [EMAIL PROTECTED] _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[EMAIL PROTECTED]"
