tech-net archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: ipfilter, return-icmp and RFC1122
On Thu, Jun 05, 2008 at 09:33:05AM -0400, Jim Wise wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wed, 4 Jun 2008, Petar Bogdanovic wrote:
>
> >Hi,
> >
> >I recently noticed that ipfilter with `block return-icmp' is returning
> >ICMP Type 3 Code 0 (Network unreachable) to the sender of a blocked
> >broadcast:
> >
> > 130.3.3.3 ---------[UDP%130.3.3.255@localhost]--------> 130.3.3.4
> > 130.3.3.3 <----[ICMP Network unreachable]---- 130.3.3.4
> >
> >
> >This seems wrong, considering RFC1122, page 39:
>
> Note that IPF makes the return ICMP code configurable. Try:
>
> block return-icmp-as-dest(port-unr)
>
> As noted down-thread, the default return value is perfectly appropriate
> for a router, but less so for an end host.
I don't think that changing the return code would make ipfilter stop
responding to broadcasts. Or did you mean something else?
Petar
Home |
Main Index |
Thread Index |
Old Index