ipfilter traffic blocking and tcpdump snort etc
horio shoichi
bugsgrief at bugsgrief.net
Fri Dec 5 18:37:00 PST 2003
On Fri, 5 Dec 2003 10:58:39 +0000
Jez Hancock <jez.hancock at munk.nu> wrote:
> Hi Horio,
>
> Cheers for reply.
>
> On Fri, Dec 05, 2003 at 07:33:49PM +0900, horio shoichi wrote:
> > On Fri, 5 Dec 2003 00:24:12 +0000
> > Jez Hancock <jez.hancock at munk.nu> wrote:
> > > Hi,
> > >
> > > I've blocked a dozen or so addresses using ipfilter:
> > >
> > > block in quick on fxp0 from 208.186.60.116 to any
> > > block in quick on fxp0 from 216.230.149.11 to any
> > >
> > > etc
> > >
> > > but I still see a lot of traffic those hosts in trafshow, snort and
> > > other packet capturing utils. Why is this?
> >
> > You are probably seeing the supposedly blocked packets on the "outside" of
> > network. Observe them on "inside", i.e., on the interface not fxp0.
> Not sure what you mean here, what command would you issue via tcpdump or
> snort to do what you suggest?
Um, that's my bad assumption !
I thought your box is a filtering router, and has at least two interfaces.
>
> > What you are seeing are packets ipfilter is just about to handle.
> Right - it's just I would have thought that ipfilter handled packets
> before they reached any traffic dumping utils. I see what you're
> getting at. Presumably snort for example uses the bpf driver via pcap(?) to
> capture network traffic...
>
> actually reading bpf(4) clears things up a little:
>
> Associated with each open instance of a bpf file is a user-settable
> packet filter. Whenever a packet is received by an interface, all file
> descriptors listening on that interface apply their filter. Each
> descriptor that accepts the packet receives its own copy.
>
The "log" keyword on blocking rules would have helped...
> > > Is there any alternative method of blocking access from certain hosts
> > > so that this traffic is not 'seen' by higher level /userland apps?
> > I don't understand your second question. Are you thinking about tcp wrapper,
> > reset feature of snort, etc ?
> Let me rephrase that one :P I meant is there a method - for example
> such as adding some kind of routing via arp - so that packets are
> dropped on the floor even quicker than they would be via the firewall
> method?
In my observation, packet filters are the quickest since blocked packets die
in ip_input(), below which is where ethernet interrupt handlers are laid out.
horio shoichi
>
> --
> Jez Hancock
> - System Administrator / PHP Developer
>
> http://munk.nu/
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
>
More information about the freebsd-questions
mailing list