[LARTC] Transparent bridging / smart rate limiting

[LARTC] Transparent bridging / smart rate limiting

[Tor Inge Kloumann]

[-- Attachment #1: Type: text/plain, Size: 1121 bytes --]

I've decided to try to make a transparent bridge, that should drop
packet's based on some weird rules.
I have googled around a bit and couldn't find any information about what
I would like to do.
And therefore I now send a mail to this mailinglist in hope that someone
can either help me, or point me in the right direction.
 
What I want to do is the following:
Make a transparent bridge that starts dropping ICMP packets that are
oversized(malicious icmp), drop all syn packets that comes from spoofed
hosts(non existent ip's), drop other obvious malicious traffic.
My problem is not dropping packets(hehe), the problem is dropping
packets based on these rules, so that legit icmp/syn traffic etc will
not be affected by the rules.
I've done some testing with hogwash as transparent bridge to intercept
and block malicious packets. I was however not able to use hogwash to
drop icmp/syn based on above clearified rules.
 
 
If someone could point me in the right direction/maybe someone has some
examples(?) I would be very greatfull.
Thanks in advance for any help.
 
Your's,
Tor Inge Kloumann
Stfu-certified engineer

[-- Attachment #2: Type: text/html, Size: 6251 bytes --]

Re: [LARTC] Transparent bridging / smart rate limiting

[Stef Coene]

On Tuesday 01 January 2002 01:25, Tor Inge Kloumann wrote:
> I've decided to try to make a transparent bridge, that should drop
> packet's based on some weird rules.
> I have googled around a bit and couldn't find any information about what
> I would like to do.
> And therefore I now send a mail to this mailinglist in hope that someone
> can either help me, or point me in the right direction.
>
> What I want to do is the following:
> Make a transparent bridge that starts dropping ICMP packets that are
> oversized(malicious icmp), drop all syn packets that comes from spoofed
> hosts(non existent ip's), drop other obvious malicious traffic.
> My problem is not dropping packets(hehe), the problem is dropping
> packets based on these rules, so that legit icmp/syn traffic etc will
> not be affected by the rules.
> I've done some testing with hogwash as transparent bridge to intercept
> and block malicious packets. I was however not able to use hogwash to
> drop icmp/syn based on above clearified rules.
>
>
> If someone could point me in the right direction/maybe someone has some
> examples(?) I would be very greatfull.
Have you read the docs about iptables?  It can match allmost everything.  
Search for the -m so you can call extra "helpers".
You can use iptables on a linux bridge, but it requires some extra patches.

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/