[lkml]   [2000]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: rp_filter against spoofing
Date (Julien Nadeau) writes:
> I was initially suggesting that Linux provides a way to drop outgoing
> packets
> with source address that doesn't match any local interface, say using a
> lookup
> table that could be occasionally sorted according to an interface's avg.
> usage;
> i was told that rp_filter drops spoofed packets; i was able to route a
> spoofed
> packet well with an unexisting source address through my router with
> rp_filter
> on an firewall ingress filtering off; the packet arrived to destination.

But it does really does ingress filtering. Are you sure that your routing
tables were correct and that it was really enabled (just echoing
it to conf/all is not enough). Also if you switch it on you need to
flush the routing cache (write something to route/flush), otherwise the
old routing cache entry that was created earlier prevents the source


This is like TV. I don't like TV.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:56    [W:0.028 / U:7.820 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site