On Wed, 21 Jun 2000, Dameon D. Welch-Abernathy wrote:
> The most useful thing you can do is drop packet fragments at your border
> router, though this may break certain kinds of legit traffic, so be careful.
Unfortunately, there doesn't seem to be a way to do this with
"traditional" Cisco IOS images (Firewall Feature Set may provide a way-
but most people don't run FFS.) Three calls to three very good people in
Cisco returned a "I can't figure out how with normal images." If you've
got other info, I'd definitely like to see it.
> Because FireWall-1 tries to re-assemble the packet before it is INSPECTed,
> it can not do anything against this sort of attack.
A *BSD or Solaris box running IPFilter up front gives the ability to drop
frags as well as log if you want to see if you're dropping legitimate
traffic (or chase the bad guys.) The frags in the current exploit code
aren't legal (the FO is too high if they were to have the preceding frag
for thier size AIR) - I'm not sure if there's a good way to filter on the
Frag Offset (or how useful it is until the code is modified.) Otherwise,
something like a Linux box or *BSD box doing frag reassembly with low TTL
on the fragments could provide good protection (I'd optimize as a router
and add *lots* of buffer space) since you'd then get the legitimate
fragged traffic. A lot of backbones are running ATM clouds, so if they're
not running LANE I'd expect fragging, but I'm not sure that it's that
prevelent in today's networks except perhaps on the fringes of the Net
(most TCP traffic has DF set.)
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
