Re: ipfw/dummynet suggestion

2002-06-29 Thread Terry Lambert
Terry Lambert wrote: > Luigi is right: the only place you can really do this at this > level is under Windows. Don't know what the heck happened here... it's supposed to read "on a per switch port basis". I think I lost part of a paragraph... -- Terry To Unsubscribe: send mail to [EMAIL PROTEC

Re: ipfw/dummynet suggestion

2002-06-29 Thread Terry Lambert
Nielsen wrote: > > Seriously, I'm wondering what "security restrictions" are so > > onerous that users are willing to change their IP addresses to > > get around them, and why they are there in the first place? > > Well in certain cases it's company policy that certain machines (ie: users) > can'

Re: ipfw/dummynet suggestion

2002-06-29 Thread Nielsen
> Seriously, I'm wondering what "security restrictions" are so > onerous that users are willing to change their IP addresses to > get around them, and why they are there in the first place? Well in certain cases it's company policy that certain machines (ie: users) can't browse the web during cer

Re: ipfw/dummynet suggestion

2002-06-29 Thread Terry Lambert
Joao Carlos wrote: > > several viruses do change the MAC address. The only real > > security is to have one user per port and filter the ports. > > Next step (but not as safe) is to wire down the arp table and only accept > > things that are in there (will be easy to implement in the > > new ipfw)

Re: ipfw/dummynet suggestion

2002-06-29 Thread Luigi Rizzo
On Sat, Jun 29, 2002 at 03:17:24PM -0300, Joao Carlos wrote: > > several viruses do change the MAC address. The only real > > security is to have one user per port and filter the ports. > > Next step (but not as safe) is to wire down the arp table and only accept > > things that are in there (will

Re: ipfw/dummynet suggestion

2002-06-29 Thread Joao Carlos
> several viruses do change the MAC address. The only real > security is to have one user per port and filter the ports. > Next step (but not as safe) is to wire down the arp table and only accept > things that are in there (will be easy to implement in the > new ipfw) I think it would be easier

Re: ipfw/dummynet suggestion

2002-06-29 Thread Luigi Rizzo
On Sat, Jun 29, 2002 at 10:02:51AM -0700, Nielsen wrote: > Usually remote MAC address. It's used for restricting users on a subnet. I > have an ugly hack that does this at present and am looking forward to the > MAC address support. Yes, I know users can conceivably change their MAC THERE IS MAC

Re: ipfw/dummynet suggestion

2002-06-29 Thread Nielsen
Usually remote MAC address. It's used for restricting users on a subnet. I have an ugly hack that does this at present and am looking forward to the MAC address support. Yes, I know users can conceivably change their MAC addresses but most would never know how. They change their IP addresses to ge

Re: ipfw/dummynet suggestion

2002-06-28 Thread Terry Lambert
Ken Ebling wrote: > >Part 1.1Type: Plain Text (text/plain) >Encoding: quoted-printable | I know this isn't performed at the ip level, but I think a useful = | addition to ipfw would be to allow filtering by mac addresses. I think = | a lot of people would find it useful, and

Re: ipfw/dummynet suggestion

2002-06-28 Thread Luigi Rizzo
On Fri, Jun 28, 2002 at 11:21:07PM -0400, Ken Ebling wrote: > I know this isn't performed at the ip level, but I think a useful addition to ipfw >would be to allow filtering by mac addresses. I think a lot of people would find it >useful, and a lot of linux users I try and ``convert'' to FreeBS