Re: ipfw newbie question

From: Jens Schweikhardt (usenet_at_schweikhardt.net)
Date: 09/30/03 

Date: 30 Sep 2003 11:40:49 GMT

surfsofa <surfsofa@hotmail.com> wrote
        in <blbjgj$a4e5u$1@ID-62754.news.uni-berlin.de>:
# What is the purpose of this rule? :
#
# allow tcp from any to any established
#
# I've seen reference to it in several places but can't figure out what it
# buys me. I'm running a web server btw.
#
# Not frightened of a technical explanation but have been struggling to find
# one.

An "established" TCP connection is one past the initial connection
setup. The difference is the ACK bit in the TCP header, which is only
set for established connections, but not during the initial setup. You
can safely allow any packet belonging to established connections if you
have constrained the connection setup: If you deny smtp from spammer.org
and openrelay.net then you can never have an established connection with
them and all packets carrying an ACK must be OK (because it is
impossible to establish a TCP connection with ACK packets). It's a
performance gain if you allow the established connection in sequenced
deny lists by putting that rule at or near the top.

Regards,

        Jens 

-- 
Jens Schweikhardt  http://www.schweikhardt.net/
SIGSIG -- signature too long (core dumped)

Relevant Pages

  • Re: Pros & cons with stealth?
    ... I used a number of different Windows raw TCP connect tools (Essential Net ... few others), to establish a connection with TESTBED, first denying, then ... 3 attempts were made by each client to establish the ... Each transaction of 3 SYN and RST ACK packets was 372 bytes. ...
    (comp.security.firewalls)
  • Re: Simulating smaller MTU? ie sending small packets.
    ... This is due to the fact that TCP ... If you want smaller packets, ... >> set there as the MSS is announced by the receiver during the ... Yes, per connection. ...
    (comp.lang.perl.misc)
  • Re: [PATCH] OpenBSD Networking-related randomization port
    ... did you read the existing Linux TCP ISN generation code? ... TCP is designed to work in an environment where packets are delayed. ... will have no effect on the current connection. ... how to choose the first sequence number ...
    (Linux-Kernel)
  • Re: Pros & cons with stealth?
    ... "Upon receiving the ACK/RST client from the target host, ... Winsock implementation of TCP, a pending connection will keep attempting to ... I captured all packets to ...
    (comp.security.firewalls)
  • [Full-disclosure] Cisco PIX TCP Connection Prevention
    ... Cisco PIX TCP ... Connection Prevention, posted on November 22, 2005. ... By sending a TCP SYN packet with an incorrect checksum through a PIX ...
    (Full-Disclosure)