Re: SunScreen Lite vs. IPF.

From: John Rowan Littell (littejo@earlham.edu)
Date: 08/14/01 

Date: Tue, 14 Aug 2001 10:55:50 -0500
From: John Rowan Littell <littejo@earlham.edu>
To: "'Focus-Sun'" <focus-sun@securityfocus.com>
Subject: Re: SunScreen Lite vs. IPF.
Message-ID: <20010814105549.C20941@earlham.edu>

Lo, Stuart Flisher and the coffee pot sang in unison:
>
> One point IPF is a packet filter (right?) whereas SunScreen is stateful
> inspection.

Depending on what exactly you mean by stateful inspection, IPF does do
it. That is to say, IPF is a packet filter that includes the ability
to look at the state of TCP connections and allow/deny packets based
on that. It can approximate that behavior for some types of UDP and
ICMP traffic as well (DNS queries, ping, traceroute), and it also
includes some basic proxy capabilities (to support, e.g. FTP). It
does not do packet payload inspection.

It is quite possible with IPF to allow outbound start-of-connection
packets (syn) and then allow all inbound and outbound packets that are
part of that connection but to always disallow inbound syn packets.

  --rowan, a long-time satisfied user of IPF on BSD systems 

-- 
John "Rowan" Littell
Systems Administrator
Earlham College Computing Services

Relevant Pages

  • Re: Apparent packet duplication logged by IPF
    ... I have enabled global logging of accepted packets by 'ipf -l pass'. ... > but it appears to be transmitted out to the internet twice. ... > 192.168.0.180,1277 PR tcp ...
    (freebsd-questions)
  • Re: Fw: Re: A question about FreeBSD security
    ... >> I prefer to use IPF 'cose of it's stateful filtering. ... My understanding is that IPFW ... whereas IPF keeps a table of outgoing packets (when told to keep ...
    (FreeBSD-Security)
  • Re: IPFILTER byte/packet counting
    ... Along with ipf you can use ipfmon which shows the following packet ... ipfmon will let you watch all the packets being blocked ... > Along with ipf you can use ipfmon which shows the following packet ...
    (FreeBSD-Security)
  • IPFILTER byte/packet counting
    ... Using IPFILTER with a bridge, can ipf count packets and bytes going ... I see things like dummynet (which only works with ... ipfw?). ...
    (FreeBSD-Security)
  • Re: IPFILTER byte/packet counting
    ... > Using IPFILTER with a bridge, can ipf count packets and bytes going ...
    (FreeBSD-Security)