Great Circle Associates Firewalls
(October 1992)

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: RE: Filters and interfaces.
From: "John P. Rouillard" <rouilj @ ra . cs . umb . edu>
Date: Mon, 5 Oct 92 18:35:19 EDT
To: bede @ linus . mitre . org
Cc: Firewalls @ GreatCircle . COM
In-reply-to: <9210051958 . AA17893 @ bede . mitre . org>; from "bede @ linus . mitre . org" at Oct 5, 92 3:58 pm

bede @
 linus .
 mitre .
 org writes:

> On Ciscos, I believe you can switch off the "ICMP x Unreachable" replies
> if they become a problem.  For example, there used to be (still are?)
> OS implementations which, when an Unreachable message was returned for
> a given destination, would forcibly terminate *all* existing local
> connections to that destination.  

Still are. Ultsux/Bugtrix/Ultrix 4.2, or 4.1 for example. Three weeks
later, DEC still hasn't escalated the problem beyond the local office.
I would figure this was a bug fixed by a patch already existant, but

OB firewalls warning:

So all of you people with Ultrix boxes out there, look out if you run
against sites with firewalls, or if you use the rfc931 feature of the
wuarchive ftp server. There may be people who can't and never will be
able to get through to you for ftp or telnet service. This same
warning applies to using the log_tcp daemons with rfc931 enabled on
these buggy machines 8-(. 

Sigh some useful software rendered less potent because of an old
kernel bug.  Does anybody else know what other boxes I should avoid
that exhibit this bug? I know SunOS 4.1.1 doesn't since I moved my
services to that box.

-- John

Indexed By Date Previous: Re: Reverse and double-reverse IP address lookups as service prerequisites
From: Aydin Edguer <edguer @ alpha . CES . CWRU . Edu>
Next: RE: Filters and interfaces.
From: randy @ psg . com (Randy Bush)
Indexed By Thread Previous: RE: Filters and interfaces.
From: bede @ linus . mitre . org
Next: RE: Filters and interfaces.
From: randy @ psg . com (Randy Bush)

Search Internet Search