Re: Best way to filter "Nachi pings"?

From: Peter Pentchev (
Date: 10/27/03

  • Next message: Poul-Henning Kamp: "Re: jail + devfs + snp problem (FreeBSD 5.1-RELEASE-p10)"
    Date: Mon, 27 Oct 2003 13:43:10 +0200
    To: Jason Stone <>

    On Mon, Oct 27, 2003 at 03:12:48AM -0800, Jason Stone wrote:
    > > > > Filtering packets by length on the other hand is a very nice feature
    > > > > to have.
    > > > As it happens, ipfw[2] does this anyway.
    > Yes, ipfw2 (ie, on fbsd-5 boxes) has an "iplen" option that you can put in
    > the body of your rule. From the manpage:
    > iplen len
    > Matches IP packets whose total length, including header and
    > data, is len bytes.
    > However, this isn't going to help most people with 4.x systems, so their
    > best option is probably still to block all pings.

    Actually, ipfw2 has been backported to -STABLE for quite a while, and
    the iplen keyword has been present in -STABLE's src/sbin/ipfw/ipfw2.c
    ever since ipfw2 was MFC'd (about July 2002). You may want to take a
    look at the ipfw(8) manual page, and specifically (as recommended at the
    top of the manpage) the 'USING IPFW2 IN FreeBSD-STABLE' section to see
    how you can actually use ipfw2 and 'iplen' in -STABLE :)


    Peter Pentchev
    PGP key:
    Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
    If there were no counterfactuals, this sentence would not have been paradoxical.

  • Next message: Poul-Henning Kamp: "Re: jail + devfs + snp problem (FreeBSD 5.1-RELEASE-p10)"

    Relevant Pages

    • Getting ipfw2 on FreeBSD-4.11-STABLE...
      ... buildworld/installworld today - but I still have ipfw and not ipfw2 - ... even though the manpage says otherwise. ... there's a switch I must implement to get ipfw2 running on here. ...
    • Re: Good reasons4 NOT choosing freebsd
      ... On 2005-09-15, Giorgos Keramidas wrote: ... > I've also seen a few who effectively contain only a short snippet ... At least I haven't seen many of the ``this manpage is outdated and may be ...
    • Re: manpages display a few strange characters
      ... man sudo ... There's nothing wrong with this manpage, it's proper utf8 encoding. ...
    • Re: Newby question - host key generation
      ... *SNIP* ... >hostkeys, but the manpage only talks about authentication keys. ...
    • Re: Alias Question
      ... Alan Connor wrote: ... > There's no manpage for set, ... Regards, ...