Re: [fw-wiz] stealth ports and IDS

From: Kevin Steves (steveskat_private)
Date: Thu Oct 03 2002 - 09:20:20 PDT

  • Next message: Bruce Platt: "RE: [fw-wiz] stealth ports and IDS"

    On Thu, Oct 03, 2002 at 10:59:29AM -0400, Anton A. Chuvakin wrote:
    > >address or stack. I do not know of a way of acheiving this using linux
    > >or netBSD etc.. and without it I would feel rather vulnerable. To help
    > Well, in Linux its really simple:
    > 
    > ifconfig eth1 up
    > 
    > with enable the interface with no IP. Just use the snort with "snort -i
    > eth1" and you are in action.
    
    A 0 addr up interface may transmit.  I know OpenBSD will currently
    respond to ARP requests for 0.0.0.0 in this case; NetBSD should not
    (from my examination of the source).  And there may be other transmit
    cases for a 0.0.0.0 up interface (I suspect there probably are)
    depending on OS.
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizardsat_private
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    



    This archive was generated by hypermail 2b30 : Thu Oct 03 2002 - 21:52:23 PDT