d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IPFW does not discard *any* IP fragments with OFF=1, only TCP ones.

Browse Source
This commit is contained in:
Ruslan Ermilov 2000-10-30 09:44:20 +00:00
parent 0dbc12d8ca
commit 0ec2d7d37a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=67937
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sbin/ipfw/ipfw.8
View File

@ -1052,12 +1052,14 @@ It is a good idea to be near the console when doing this.
Don't forget the loopback interface.
.El
.Sh FINE POINTS
.Bl -bullet
.It
There is one kind of packet that the firewall will always
discard, that is an IP fragment with a fragment offset of
discard, that is a TCP packet's fragment with a fragment offset of
one.
This is a valid packet, but it only has one use, to try
to circumvent firewalls.
.Pp
.It
If you are logged in over a network, loading the
.Xr kld 4
version of
@ -1075,7 +1077,7 @@ ipfw flush
.Ed
.Pp
in similar surroundings is also a bad idea.
.Pp
.It
The
.Nm
filter list may not be modified if the system security level
@ -1085,6 +1087,7 @@ see
.Xr init 8
for information on system security levels
.Pc .
.El
.Sh PACKET DIVERSION
A
.Xr divert 4