example sniffers for DFD now available

2006-03-06 Thread Travis H.
Hi, the latest release of dfd_keeper, version 3.3, has a sample script which now implements a new command, bittorrent. This allows a client behind NAT to receive connections from other bittorrent clients. Right now it simply gives this privilege for the last client to ask for it, and assumes

dfd_sniff script

2006-03-06 Thread Travis H.
Sorry, hit send by reflex. Script attached. -- Security Guru for Hire http://www.lightconsulting.com/~travis/ -- GPG fingerprint: 9D3F 395A DAC5 5CCC 9066 151D 0A6B 4098 0C55 1484 dfd_sniff.py Description: Binary data

Re: pf blocking certain SYN packets

2006-03-06 Thread Daniel Hartmeier
On Sat, Mar 04, 2006 at 08:00:17AM -0800, Dmitriy wrote: Looking at my tcpdump output above, it looks like the new connection uses port 1019, while the old connection used 1020. So that shouldn't be a problem. In your output, there is no indication whether port 1019 was previously used, but

pfctl: anchor name too long

2006-03-06 Thread Ingolf Zeiner Petersen
Just a quick question: Does this really look wrong? [EMAIL PROTECTED] /sbin/pfctl -a upnpd/rl1-TCP-81.111.111.11-42193-10.0.0.123-42193 pfctl: anchor name 'upnpd/rl1-TCP-81.111.111.11-42193-10.0.0.123-42193' too long [EMAIL PROTECTED] Could it be some new functionality that i'm missing in my

Re: pfctl: anchor name too long

2006-03-06 Thread Daniel Hartmeier
On Mon, Mar 06, 2006 at 08:44:23PM +0100, Ingolf Zeiner Petersen wrote: Could it be some new functionality that i'm missing in my bit old PF version, runing on my FreeBSD 5.4-RELEASE-p6 ? Yes, FreeBSD 5.x is based on OpenBSD 3.5 pf, where the anchor name was limited to 16 characters. OpenBSD

Re: Confused about use of pfctl_get_pool() in pfctl_show_rules()

2006-03-06 Thread Daniel Hartmeier
On Sat, Mar 04, 2006 at 04:04:23PM +0100, Sven Ingebrigt Ulland wrote: What exactly does pfctl_get_pool() do, and why is it there? I did not get much smarter by looking at the function and trying to figure out what it does. It runs DIOCGETADDRS to get the ticket, and then DIOCGETADDR, both of

Re: Confused about use of pfctl_get_pool() in pfctl_show_rules()

2006-03-06 Thread Sven Ingebrigt Ulland
On Mon, Mar 06, 2006 at 09:25:23PM +0100, Daniel Hartmeier wrote: On Sat, Mar 04, 2006 at 04:04:23PM +0100, Sven Ingebrigt Ulland wrote: What exactly does pfctl_get_pool() do, and why is it there? I did not get much smarter by looking at the function and trying to figure out what it does.

Re: pfctl: anchor name too long

2006-03-06 Thread Jon Simola
On 3/6/06, Daniel Hartmeier [EMAIL PROTECTED] wrote: Yes, FreeBSD 5.x is based on OpenBSD 3.5 pf, where the anchor name was limited to 16 characters. OpenBSD 3.6 increased the limit to 64 characters, which was imported into FreeBSD 6.x. In a related question, is there a non-obvious reason