On Fri, 3 Sep 2004 [email protected] wrote: > Send freebsd-security mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freebsd.org/mailman/listinfo/freebsd-security > or, via email, send a message with subject or body 'help' to > [email protected] > > You can reach the person managing the list at > [email protected] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of freebsd-security digest..." > > > Today's Topics: > > 1. Re: IPFW and icmp (Kevin D. Kinsey, DaleCo, S.P.) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 02 Sep 2004 12:05:26 -0500 > From: "Kevin D. Kinsey, DaleCo, S.P." <[email protected]> > Subject: Re: IPFW and icmp > To: Dave <[email protected]> > Cc: [email protected] > Message-ID: <[email protected]> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Dave wrote: > >> I'm not a master of the internet RFCs, but I do believe icmp messages have >> different types. >> >> Now to enable traceroute for IPFW, I might put in a rule like this: >> >> ipfw add pass icmp from any to me >> >> However, how would I make a rule to limit icmp messages to just those used >> by traceroute? Can the messages be distinguished as such? >> >> >> > > I use, thus far, "allow icmp from any to any icmptypes 0,3,4,8,11". That > include 'echo request', of course. Someone else may have a better idea. > >> A dynamic rule that exists only for the duration of a traceroute execution >> would be even better. I take it 'setup' or 'check-state' would follow in >> that case? >> >> >> > Seems likely. *sigh* one more manpage to read.... ;-) > > Kevin Kinsey > > ------------------------------ > > _______________________________________________ > [email protected] mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "[email protected]" > > End of freebsd-security Digest, Vol 75, Issue 2 > *********************************************** > > You guys should check out this link here for the ICMP types. http://www.iana.org/assignments/icmp-parameters might help you out a little. This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"