freebsd-pf Digest, Vol 263, Issue 3

[文鳥]

> Already many thanks for the info. I'v added already the "set
> block-policy drop". I'v done an nmap and it's apparently able to find
> out the setting below of my pf FW: 
> 
> MAC Address: 00:0E:2E:xx:xx:xx (Edimax Technology Co.) 
> Warning: OSScan results may be unreliable because we could not find
> at least 1 open and 1 closed port Device type: general purpose 
> Running: FreeBSD 7.X 
> OS details: FreeBSD 7.1-PRERELEASE 
> Uptime guess: 0.000 days (since Wed Oct 07 16:02:00 2009) 
> Network Distance: 1 hop 
> TCP Sequence Prediction: Difficulty=260 (Good luck!) 
> IP ID Sequence Generation: Incremental 
> Service Info: OS: FreeBSD 
> 
> 
> Is there a way to block this info? 

Possible, but may be disruptive to your networking, depending on
your network environment and what you block. As I know nothing about
your setup or pf.conf, and thus cannot tell you anything more specific,
I will just explain what you can do to investigate and reduce the flow
of data, but from there on you're on your own.

First of all, check what ICMP messages come through and consider
blocking these (take a look at the relevant RFCs first, though).

Secondly, you can capture the data that nmap sends and the other
end's replies using tcpdump, wireshark, whatever. Of interest are the
responses you actually get from the scanned host. Find out what
protocols those responses belong to (google, etc.), decide
whether it is worthwile to block that data and, finally, check 'man
pf.conf' to see how to do just that.

BTW: please limit the amount of text you quote.