Can netfilter do this?
I have been searching the archived lists without any success to have the following question answered:
Is netfilter capable of knowing when someone is crafting SMTP (or FTP or HTTP or ...) packets that violate RFC rules to exploit a vulnerability in some server?
Quoted 3 lines · Joe Mott
Is netfilter capable of knowing when someone is crafting SMTP (or FTP or HTTP or ...) packets that violate RFC rules to exploit a vulnerability in some server?
No, application-level filtering / analysis is outside the scope of netfilter.
Cheers,
Gavin.
Quoted 6 lines · Joe Mott
I have been searching the archived lists without any success to have the following question answered:
Is netfilter capable of knowing when someone is crafting SMTP (or FTP or HTTP or ...) packets that violate RFC rules to exploit a vulnerability in some server?
No, that is the job for some form of IDS, such as Snort. Whilst netfilter can look inside the contents of packets it can only do so on a packet by packet basis. An HTTP request, SMTP conversation (etc) is likely to be so large it spans multiple packets. When text wraps the boundary of one packet netfilter can no longer help, some form of reassembly is required before the "full" text can be read and taken into context.
David
Quoted 6 lines · Joe Mott
I have been searching the archived lists without any success to have the following question answered:
Is netfilter capable of knowing when someone is crafting SMTP (or FTP or HTTP or ...) packets that violate RFC rules to exploit a vulnerability in some server?
As the other replies say, the short answer is no.
You can do some filtering using the netfilter POM patches, like string matching, TOS, TCP flags.
Regards
Ray
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Quoted 7 lines · Joe Mott
I have been searching the archived lists without any success to have the following question answered:
Is netfilter capable of knowing when someone is crafting SMTP (or FTP or HTTP or ...) packets that violate RFC rules to exploit a vulnerability in some server?
Hi,
what you need is an IDS (intrusion detection system). The most well known are prelude (prelude-ids.org) and snort.
Did I mention that I don't trust snort because of too much passed vulnerabilities?
Regards
Frederic
--
< Ylli> lol je rigole neuro jte prend pa pr un pervers ms un president et pere de famille respectable :s
http://www.seclab.jp