Re: does anyone use pf.os?

pakrat_at_localhost.private.neotoma.org
Date: 06/23/04 

Date: Wed, 23 Jun 2004 16:21:15 GMT

On Tue, 22 Jun 2004 21:53:54 -0400 in <7hohd0d66sn1tmes12mnfbvt1njc9kmcog@4ax.com> Peter Matulis <petermatulis@yahoo.ca> wrote:
> Hi, I'm looking for real-world examples on the use of os fingerprinting.
> Since it is fairly easy to thwart I wonder why the OpenBSD bothered with
> it. Or maybe I'm missing something? Any comments welcome.

I use it in conjunction with spamd.
rdr inet proto tcp from !<mynets> os "Windows" to any port smtp tag SPAMD -> 12
7.0.0.1 port 8025
There is presently no legitimate reason for my home machine to receive
email from a windows box and all of the SMTP connects from windows boxes
currently come from compromised windows boxes looking for SMTP relays
or M$ Exchange servers for a virus infested company with a couple folks
that read USENET. 

-- 
Chris Dukes
"I'm not really all that interested in what Hollywood does with its stuff. 
I mean, they're only the size of the porn industry."  -- Bruce Sterling
"my vibe is going dave, I can feel it." -- Jasmine