How to configure iptables to block a land attack?
Hi,
http://www.linux-firewall-tools.com/linux/
Try this link or use Google.com to search
Land Attack is when a spoofed packet with its source and dest. address set to ur localhost addr (127.0.0.1) is send to u via ext. interface (someone correct me if i am wrong :) )
Just configure ur iptables to reject packets from interfaces with source addr = 127.0.0.1 and dest addr = 127.0.0.1
Tace
---
Consciousness:
that annoying time between naps
The only cure for insomnia is:
to get more sleep
Quoted 27 lines · TCS)
Hi Friends,
Can anyone tell me how should I configure my IPTABLES Firewall to block a LAND ATTACK?
I am new to firewalling..I am running RedHat Linux 8.0 and iptables.Can anyone send me a standard iptables configuration for all the common attacks?
I would like to know what are all the common atacks and explaination about them.
Can you direct me to some good link where I can find information on this topic?Thanks and Regards,
Pradeep-----Original Message-----
From: terry white [mailto:[email protected]]
Sent: Friday, March 14, 2003 2:18 AM
To: linux-admin
Subject: RE: how to minimize/maximize/restore an open window in linux
...on "3-13-2003" "Sadanapalli, Pradeep Kumar (MED, TCS)" writ:
Quoted 24 lines
: I am using RedHat linux 8.0 . I am running KDE .
... that is the install i'm running on one of my machines.
i just checked, and when a window is open, 'left' click on the '-'
at
the "top right" of that window, and it disappears into a 'pane' at the bottom of the desktop. 'left' click that, and it reappears ...Signature · 12 lines
... i'm a man, but i can change, if i have to , i guess ... - To unsubscribe from this list: send the line "unsubscribe linux-admin" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html - To unsubscribe from this list: send the line "unsubscribe linux-admin" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
_____________________________________________________________
Get 25MB, POP3, Spam Filtering with LYCOS MAIL PLUS for $19.95/year.
http://login.mail.lycos.com/brandPage.shtml?pageId=plus&ref=lmtplus
... shamelessly stolen: (courtesy goodle)
Description: Sending a packet to a machine with the source host/port the same as the destination host/port crashes a lot of boxes.
Author: m3lt <[email protected]>
Compromise: Remote DOS attack (reboots many systems) Vulnerable Systems: Windows95, Windows NT 4.0, WfWG 3.11, FreeBSD
Date: 20 November 1997
on "3-16-2003" "Tace " writ:
: Land Attack is when a spoofed packet with its source and dest. address : set to ur localhost addr (127.0.0.1) is send to u via ext. interface : (someone correct me if i am wrong :) )
my ipaddr is 206.124.156.178. given the above. the "land attack"
would set 'source' and 'destination' addresses to "206.124.156.178", with identical port numbers.
127.0.0.1 is defined as 'localhost' and won't route.
: Just configure ur iptables to reject packets from interfaces with : source addr = 127.0.0.1 and dest addr = 127.0.0.1
could be wrong, but i doubt a packet with the localhost ip is going
to see any such interface ...
Signature · 2 lines
... i'm a man, but i can change,
if i have to , i guess ...Quoted 2 lines · Tace
Just configure ur iptables to reject packets from interfaces with source addr = 127.0.0.1 and dest addr = 127.0.0.1
More generally, source and destination addresses should match the interface; in most cases:
1. 127.x.x.x shouldn't occur as either the source or destination address for any interface other than loopback.
2. Packets with one of your IP addresses as the destination address shouldn't be sent to any interface except loopback, and packets with one of your IP addresses as the source address shouldn't be received from any interface except loopback.
3. Private IP addresses (e.g. 192.168.x.x) shouldn't occur as either the source or destination address for an external (e.g. dial-up) interface.
4. Routable local IP addresses shouldn't occur as the destination address for any packet sent to an external (e.g. dial-up) interface, and shouldn't occur as the source address for any packet received from an external interface.
Signature · 1 line
Glynn Clements <[email protected]>