[lkml]   [2000]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: rp_filter against spoofing
    Date (Julien Nadeau) writes:
    > I was initially suggesting that Linux provides a way to drop outgoing
    > packets
    > with source address that doesn't match any local interface, say using a
    > lookup
    > table that could be occasionally sorted according to an interface's avg.
    > usage;
    > i was told that rp_filter drops spoofed packets; i was able to route a
    > spoofed
    > packet well with an unexisting source address through my router with
    > rp_filter
    > on an firewall ingress filtering off; the packet arrived to destination.

    But it does really does ingress filtering. Are you sure that your routing
    tables were correct and that it was really enabled (just echoing
    it to conf/all is not enough). Also if you switch it on you need to
    flush the routing cache (write something to route/flush), otherwise the
    old routing cache entry that was created earlier prevents the source


    This is like TV. I don't like TV.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:56    [W:0.020 / U:2.104 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site