Messages in this thread |  | | From | Alan Cox <> | Subject | Re: Firewalling in recent kernels | Date | Thu, 16 May 1996 10:21:00 +0100 (BST) |
| |
> > I'm somewhat unsure whether this is a good idea, since actually > > the destination host might be reachable through other ports. > > (And I wouldn't be astonished if some OS takes such an ICMP as > > a reason to drop all already established connections to that > > destination.)
Certain 4.2 BSD derived systems do indeed drop all connections to that destination. Its a bug on their part and very exploitable as Im sure you can imagine.
> Hmm, shouldn't we be useing one of the higher (uncommented, 6-12) numbers > in the codes for UNREACH section in <linux/icmp.h> ?
Someone was supposed to be testing the effect of the newer options on old stacks and seeing what occured. I've not heard anything back yet.
Alan
|  |