Re: [fw-wiz] Firewalls that generate new packets..

jdgorin@xxxxxxxxxxxx wrote:
I also remember that early Checkpoint firewalls broke FTP connection if the PORT
command and the PORT arguments were sent in differents packets (back in those
old times, some FTP gateway did that kind of tricks).
That was deep but not smart inspection!

That was a side effect of the fact that they didn't do TCP reassembly,
packet defragmentation, or re-ordering. I always figured that they were
just doing a case-independent compare for "PORT " at the beginning
of the packet data.

Heck of a "state" engine, huh?


firewall-wizards mailing list