OpenBSD Journal

New pf feature: TCP connection rate tracking

Contributed by mk/reverse on from the not-so-fast-buddy dept.

"Jona/BSD" notified us that Ryan Thomas McBride committed some additional features to our favourite packet filter which make it possible to limit both TCP connection count and connection establishment rate based on the source address.

Find the commit messages for kernel part and userland part on MARC.

This looks really interesting, so do some testing. Remember to report all problems you might encounter but try doing some debugging on your own first.

(Comments are closed)

Comments

  1. By Anonymous Coward (24.102.88.31) on

    Very cool!

    I assume <bad> can be defined as "not <good>" too. Some of us prefer to use whitelisting.

    Comments

    1. By Michael Knudsen (217.157.199.114) on

      > I assume <bad> can be defined as "not <good>" too. Some of us
      > prefer to use whitelisting.

      You're confusing things. <bad> (or whatever you choose) is the table to which violaters' ip-addresses are added. This is essentially a blacklisting approach.

  2. By Sven (80.126.65.121) on

    Here's the correct link for the kernel part

    Comments

    1. By Michael Knudsen (217.157.199.114) on

      Whoops, I've updated the link in the story now. Thanks for pointing this out. I wrongfully assumed that the submitted link was to the first commit, i.e. the kernel part of the change.

  3. By Anonymous Coward (24.201.62.155) on

    Damn, OpenBSD and stuff never fails to amaze and impress me! Now if only large corporations, (Cisco, MS, etc. etc.) would openly donate resources and/or money for such a good cause, it would be great for them (parhaps marketing wise), for *BSD, Linux, and well, for everyone else too!

    Comments

    1. By James (151.203.124.250) on

      They have no reason to donate to a free alternative to their stuff.

      Comments

      1. By Anonymous Coward (24.201.62.155) on

        I understand your point, which is true, but then there's always things such as OpenSSH...

        Comments

        1. By James (151.203.124.250) on

          I understand this to be a situation where it's OpenSSH included in a proprietary product. If you mean to say it'd be nice if the vendors used pf instead of their packet filter, I think this is different because with OpenSSH, it's a nice addition to their OS, which is the main product, where the packet filtering system _IS_ the reason you'd buy a cisco firewall. If Cisco's was the same as everyone else's, they've got no edge.

          Comments

          1. By Anonymous Coward (69.197.92.181) on

            The only edge cisco has is having brain washed PHBs into thinking cisco makes good products. From a technical standpoint, cisco does not make the best product under any category, with the possible exception of very high end multi-Gbps routers, depending on the day.

            Comments

            1. By Anonymous Coward (68.165.27.173) on

              If Juniper is doing that good, it's because of the incompetence of Cisco.

            2. By James (151.203.124.250) on

              That doesn't have anything to do with how business's think about whether or not to include software in their systems.

              Comments

              1. By Anonymous Coward (69.197.92.181) on

                And? You claimed cisco would have no edge. The fact is, cisco does not have a technology edge, they could use anything and it would not matter at all, their edge is in the minds of management types with too much money on their hands.

                Comments

                1. By James (129.10.214.125) on

                  I was claiming that the edge is that their unique in some way, not that the technology is better. Being unique is essential if you plan to convince customers your stuff is better than someone elses.

                  Comments

                  1. By Anonymous Coward (69.197.92.181) on

                    No, it isn't. That's the whole point. The customers that buy cisco don't know or care what is in a cisco. Oddly, people still buy pix even though its just a really low end PC with crappy filtering software. Unique has nothing to do with it, mindshare is their only edge.

  4. By Anonymous Coward (69.132.141.94) on

    While we're on this topic, does anyone know if the pf synproxy fix will be available as a patch on errata.html?

    Comments

    1. By jtorin (194.103.189.24) on

      Well, why don't you download the lastest version yourself and recompile?

  5. By Ondrej Suchy (194.108.74.252) ondrej.suchy@logios.cz on http://www.logios.cz/

    The CVS commit message incorrectly uses the keyword "overflow". Correct keyword is "overload". Ondrej

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]