Hi,
> Do the Ascend products allow you to refuse fragmented packets, or to
> defrag them? If not, stateful packet filtering is pretty useless,
> given that a skilled attacker can simply frag the packet so that a
> decision is made on incomplete information (i.e., source/destination
> address, but not source/destination ports...)
With a statefull filter you can simply Check syn/ack sequence numbers to
block out packages with dont belong to exisitng connections. (of course I
dont know if Ascend does this. At least this is better than fragment
blocking/defragemnting).
Greetings
Bernd
--
(OO) -- Bernd_Eckenfels @
Wittumstrasse13 .
76646Bruchsal .
de --
( .. ) ecki @
lina .
{inka .
de,ka.sub.org} http://home.pages.de/~eckes/
o--o *plush* 2048/A2C51749 eckes @
irc +4972573817 *plush*
(O____O) If privacy is outlawed only Outlaws have privacy
Follow-Ups:
References:
|
|
