[pf4freebsd] Re: fixing out of order first fragment processing?

[Max Laier]

On Friday 23 July 2004 00:32, othermark wrote:
> Max Laier wrote:
> > On Thursday 22 July 2004 23:34, othermark wrote:
> > Activation of pf with a
> > scrub in on <interface> fragment reassemble
> > rule works as workaround.
>
> Thanks for this suggestion,
>
> I have a 'scrub in all fragments reassemble' that I just added and loaded
> to my /etc/pf.conf, which does not seem to solve the problem.  Do I have to
> specify a scrub for each interface in this case (maybe a better question
> for the pf list)?

Moved. It actually should. Can you please try to # pfctl -x misc and check the 
console? I might well have something wrong, need to cross check.

> > In every case you have to decide if you want to
> > invest the required memory to store fragments, which might make you
> > easy/easier prey for DoS-attacks. Usually, for an average gateway the
> > cost is worth the gain (= increased security).
>
> Most of the current systems today are able to handle both types of
> sequences.   It really is a small processing hit, FreeBSD already does
> some bufferring with proper safeguards/maximums for various
> traffic patterns.
>
> I would suspect some NFS/udp interoperability problems with the way it
> handles fragments right now.
>
> --
> othermark
> atkin901 at nospam dot yahoo dot com
> (!wired)?(coffee++):(wired);
>
> _______________________________________________
> freebsd-current at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe at freebsd.org"

-- 
/"\  Best regards,			| mlaier at freebsd.org
\ /  Max Laier				| ICQ #67774661
 X   http://pf4freebsd.love2party.net/	| mlaier at EFnet
/ \  ASCII Ribbon Campaign		| Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 194 bytes
Desc: signature
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20040916/4e1b8dac/attachment.bin