From: Chris Friesen <chris.friesen@genband.com>
To: sclark46@earthlink.net
Cc: "Pascal Hambourg" <pascal@plouf.fr.eu.org>,
"Rémi Denis-Courmont" <remi@remlab.net>,
"Linux Kernel Network Developers" <netdev@vger.kernel.org>
Subject: Re: Linux vs FreeBSD Which is correct.
Date: Fri, 19 Aug 2011 10:18:54 -0600 [thread overview]
Message-ID: <4E4E8CEE.102@genband.com> (raw)
In-Reply-To: <4E4D08B8.8020309@earthlink.net>
On 08/18/2011 06:42 AM, Stephen Clark wrote:
> I guess I don't really understand what reverse path filter stuff is all
> about, much less making it weaker.
> But using 2 made the pings responses be seen.
It's described in RFC3704. The idea is to block spoofed packets.
From Documentation/networking/ip-sysctl.txt:
rp_filter - INTEGER
0 - No source validation.
1 - Strict mode as defined in RFC3704 Strict Reverse Path
Each incoming packet is tested against the FIB and if the interface
is not the best reverse path the packet check will fail.
By default failed packets are discarded.
2 - Loose mode as defined in RFC3704 Loose Reverse Path
Each incoming packet's source address is also tested against the FIB
and if the source address is not reachable via any interface
the packet check will fail.
Current recommended practice in RFC3704 is to enable strict mode
to prevent IP spoofing from DDos attacks. If using asymmetric routing
or other complicated routing, then loose mode is recommended.
The max value from conf/{all,interface}/rp_filter is used
when doing source validation on the {interface}.
Default value is 0. Note that some distributions enable it
in startup scripts.
--
Chris Friesen
Software Developer
GENBAND
chris.friesen@genband.com
www.genband.com
next prev parent reply other threads:[~2011-08-19 16:19 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-17 17:03 Linux vs FreeBSD Which is correct Stephen Clark
2011-08-17 17:10 ` Emil S Tantilov
2011-08-17 17:20 ` Stephen Clark
2011-08-17 17:17 ` Rémi Denis-Courmont
2011-08-17 19:44 ` Stephen Clark
2011-08-17 20:15 ` Pascal Hambourg
2011-08-18 12:42 ` Stephen Clark
2011-08-19 16:18 ` Chris Friesen [this message]
2011-08-19 19:10 ` Stephen Clark
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E4E8CEE.102@genband.com \
--to=chris.friesen@genband.com \
--cc=netdev@vger.kernel.org \
--cc=pascal@plouf.fr.eu.org \
--cc=remi@remlab.net \
--cc=sclark46@earthlink.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).