Re: Firewall rules that discriminate by connection duration
From: Peter Jeremy (PeterJeremy_at_optushome.com.au)
Date: 11/10/04
- Previous message: Xin LI: "Re: Is there any way to know if userland is patched?"
- In reply to: Vlad GALU: "Re: Firewall rules that discriminate by connection duration"
- Next in thread: John Webster: "Re: Firewall rules that discriminate by connection duration"
- Reply: John Webster: "Re: Firewall rules that discriminate by connection duration"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 11 Nov 2004 05:36:06 +1100 To: Vlad GALU <vladgalu@gmail.com>
On Wed, 2004-Nov-10 13:23:21 +0200, Vlad GALU wrote:
>On Tue, 9 Nov 2004 20:10:30 -0700 (MST), Brett Glass <brett@lariat.org> wrote:
>> I'm interested in crafting firewall rules that throttle connections
>> that have lasted more than a certain amount of time. (Most such
>> connections are P2P traffic, which should be given a lower priority
>> than other connections and may constitute network abuse.) Alas, it
>> doesn't appear that FreeBSD's IPFW can keep tabs on how long a
>> connection has been established. Is there another firewall for
>> FreeBSD that can?
>
> All firewalls in FreeBSD can, actually. It's part of the stateful
>inspection feature. The only thing they lack is a match parameter
>based on the timer.
That's a bit of a stretch. Stateful inspection associates a single
timeout with each connection. The timeout is reset when a valid
packet is seen on that connection and the connection blocked if the
timeout expires.
Brett needs a timeout that is initialised when the connection is setup
and not reset. When it expires, you need to perform some different
action rather than just block the connection. You might be able to
reuse some of the existing stateful inspection code but I don't
believe it's a trivial change.
-- Peter Jeremy _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
- Previous message: Xin LI: "Re: Is there any way to know if userland is patched?"
- In reply to: Vlad GALU: "Re: Firewall rules that discriminate by connection duration"
- Next in thread: John Webster: "Re: Firewall rules that discriminate by connection duration"
- Reply: John Webster: "Re: Firewall rules that discriminate by connection duration"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
