Re: packet filtering as a virtual machine

2005-10-25 Thread Travis H.
They would have to have been really serious about protecting their patent to threaten Sun; remember that almost all FW1 installations (checkpoints cash cow) were dependant on solaris boxes. Perhaps. OTOH, if you don't protect IP, you lose it. That is why so many warnings about infringement

Re: Adding support for FTP

2005-10-25 Thread James Wright
Kevin said the following on 10/24/05 12:55: On 10/24/05, Daniel Hartmeier [EMAIL PROTECTED] wrote: On Mon, Oct 24, 2005 at 06:14:49PM +0930, Aluminium Oxide wrote: While is the satisfactory and workable solution using a rdr and passing the role to an ftp-proxy, I would like to add to

Re: packet filtering as a virtual machine

2005-10-25 Thread Markus Friedl
On Mon, Oct 24, 2005 at 02:38:43AM -0500, Travis H. wrote: Has anyone thought of modeling packet filtering/translation/queueing as a virtual machine? BSD/OS ipfw (http://www.pix.net/software/ipfw/) did use BPF bytecode for filterrules. basically you compile you filter ruleset into BPF bytecode

Re: Adding support for FTP

2005-10-25 Thread Travis H.
http://www.enyo.de/fw/security/java-firewall/ Towards the end... RFC 3514... check the date on that RFC. HHOS at its best. -- http://www.lightconsulting.com/~travis/ -- We already have enough fast, insecure systems. -- Schneier Ferguson GPG fingerprint: 50A1 15C5 A9DE 23B9 ED98 C93E 38E9

Re: Adding support for FTP

2005-10-25 Thread Travis H.
I am attempting to do something along these lines using a python+pcap sniffer to watch for certain traffic, and use DFD (specifically dfd_keeper) to make the changes to the firewall. It will also be able to tear down the connection when it sees it close (or after a timeout - rules can be made

Re: no scrub reassemble tcp from foo to bar

2005-10-25 Thread Jon Hart
On Thu, Oct 20, 2005 at 08:24:32AM -0400, Jon Hart wrote: On Wed, Oct 19, 2005 at 07:51:13PM -0600, jared r r spiegel wrote: On Tue, Oct 18, 2005 at 11:50:41AM -0400, Jon Hart wrote: What I'd like is to disable scrub's tcp reassembly on per host/port/protol basis, something along the

Load Balancing Outgoing, its possible ?

2005-10-25 Thread Daniel Dias Gonçalves
Complicated ? Its possible ? TELECOM LOAD SHARING PER PACKET -- | | |