On Fri, Mar 13, 2009 at 10:15:06AM +, Stuart Henderson wrote:
On 2009/03/13 10:25, Jeremie Le Hen wrote:
It doesn't seem to be possible to disable sequence number/window
tracking. Does it?
It's possible if you port the sloppy state handling code from OpenBSD..
Using 'sloppy' is a
Daniel,
On Thu, Mar 12, 2009 at 04:01:38PM +0100, Daniel Hartmeier wrote:
The following scenario would produce what you observe:
1) nmap sends a first TCP SYN to AAA.BBB.CCC.DDD with a random
initial sequence number th_seq1
2) pf allows the packet out and creates a state entry
On 2009/03/13 10:25, Jeremie Le Hen wrote:
It doesn't seem to be possible to disable sequence number/window
tracking. Does it?
It's possible if you port the sloppy state handling code from OpenBSD..
On Fri, Mar 13, 2009 at 10:25:15AM +0100, Jeremie Le Hen wrote:
% Mar 13 08:18:52 yoda /netbsd: pf: BAD state: TCP 82.233.239.98:39225
82.233.239.98:39225 88.187.38.85:80 [lo=3443494040 high=3443494041 win=2048
modulator=0] [lo=0 high=1 win=1 modulator=0] 2:0 S seq=3041360721 ack=0 len=0
Dear list,
I'm running a firewall using pf under NetBSD 4.0.1. I've experienced a
weird problem with appear to be due to the outgoing rule:
% pass out quick all keep state
I first noticed it when I ran nmap -sS (uses raw sockets) and got:
% yoda# nmap -sS AAA.BBB.CCC.DDD
% Starting Nmap
On Thu, Mar 12, 2009 at 10:13:53AM +0100, Jeremie Le Hen wrote:
% yoda# nmap -sS AAA.BBB.CCC.DDD
% Starting Nmap 4.65 ( http://nmap.org ) at 2009-03-12 08:00 CET
% sendto in send_ip_packet: sendto(4, packet, 44, 0, AAA.BBB.CCC.DDD, 16) =
No route to host
% Offending packet: TCP
