TFTP ..unable to track...

TFTP ..unable to track...

[Gautham Thavva]

I have a linux firewall (using iptables 1.2.6a). This machine is running a TFTP client. I am unable to track the TFTP sessions.

I have built the tftp.patch, the netfilter tracking module for tftp by Magnus Boden. I have not been able to track the sessions.

The TFTP Read Request goes to the destination port 69 at the server side. The packets at the INPUT side to the firewall is at a port for which I have no prior knowledge.

Please can someone suggest a way to filter in only the tftp packets.

with regards,
Gautham Thavva




____________________________________________________________
Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail!
http://login.mail.lycos.com/r/referral?aid=27005

Re: TFTP ..unable to track...

[Cedric Blancher]

Le lun 12/05/2003 à 17:37, Gautham Thavva a écrit :
> This machine is running a TFTP client. I am unable to track the TFTP
> sessions.

See patch-o-matic. There's a patch for TFTP conntrack.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: TFTP ..unable to track...

[Gautham Thavva]

I did use the *tftp.patch* by Magnus Boden in the patch-o-matic. I tried to track after applying this patch but was not successful.

I understood going through the patch that it will work if the firewall is in place on a machine that is running the tftp server. 

In this case, it is a tftp client on the machine. Is my understanding correct? Please can you suggest another way.

regards,
Gautham



--------- Original Message ---------

DATE: 16 May 2003 08:39:14 +030
From: Cedric Blancher <blancher@cartel-securite.fr>
To: gautham.thavva@lycos.com
Cc: netfilter@lists.netfilter.org

>Le lun 12/05/2003 ` 17:37, Gautham Thavva a icrit :
>> This machine is running a TFTP client. I am unable to track the TFTP
>> sessions.
>
>See patch-o-matic. There's a patch for TFTP conntrack.
>
>-- 
>Cidric Blancher  <blancher@cartel-securite.fr>
>IT systems and networks security - Cartel Sicuriti
>Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
>PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE
>
>



____________________________________________________________
Get advanced SPAM filtering on Webmail or POP Mail ... Get Lycos Mail!
http://login.mail.lycos.com/r/referral?aid=27005