Re: [Full-Disclosure] Windows SP2 firewall: Famous for 3 seconds?
From: Darren Reed (avalon_at_caligula.anu.edu.au)
Date: 02/26/04
- Previous message: Scott Connors: "Re: [Full-Disclosure] Need help in performing a remotevulnerability scan"
- In reply to: Sebastian Niehaus: "[Full-Disclosure] Windows SP2 firewall: Famous for 3 seconds?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: killedbythoughts@mindcrime.net (Sebastian Niehaus) Date: Thu, 26 Feb 2004 16:08:37 +1100 (Australia/ACT)
In some mail from Sebastian Niehaus, sie said:
>
> [...]
>
> | What existing functionality is changing in Service Pack 2 for Windows
> | XP?
> |
> |
> | Enhanced multicast and broadcast support
> |
> | Detailed description
> |
> | Multicast and broadcast network traffic differ from unicast traffic
> | because the response comes from an unknown host. As such, stateful
> | filtering prevents the response from being accepted. This stops a
> | number of scenarios from working, ranging from streaming media to
> | discovery.
> |
> |
> | To enable these scenarios, Windows Firewall will allow a unicast
> | response for 3 seconds from any source address on the same port from
> | which the multicast or broadcast traffic originated.
>
> Sounds like a broken concept, as always. Eh?
Not necessarily. Details are always in the implementation (and I think
that description is likely worded wrongly.)
This has much bigger significance for IPv6 where ARP messages have been
replaced with ICMPv6 messages.
Darren
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Scott Connors: "Re: [Full-Disclosure] Need help in performing a remotevulnerability scan"
- In reply to: Sebastian Niehaus: "[Full-Disclosure] Windows SP2 firewall: Famous for 3 seconds?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
