[j-nsp] Block port 0 traffic

[Richard A Steenbergen]

On Wed, Oct 13, 2004 at 11:39:37AM -0700, Eli Dart wrote:
> 
> In reply to Richard A Steenbergen <ras at e-gerbil.net> :
> > 
> > You aren't actually seeing port 0 traffic, you're seeing fragmented IP 
> > packets without a L4 header, which shows up as src/dst port 0 in "show 
> > firewall log" and such. Common question, it might be helpful to put some 
> > indicator so users can tell the difference.
> 
> This can be a bit of a problem if you are filtering based on layer-4 
> port.  Apparently Junipers match the bit offsets for layer-4 ports 
> against IP fragments -- so, if you are blocking a given port you can 
> blow away portions of legitimate fragmented IP packets, if the data 
> in the packet happens to match whatever port you are blocking.
> 
> The way around this is to allow frags that are not the first frag 
> through before your port blocks.

IIRC the documentation states that layer 4 information like ports are 
matched against by offset without checking for protocol, thus you are 
encouraged to remember to include "from protocol [ tcp udp ]" and/or 
is-fragment in your firewall terms.

The not so well known corollary is that ports will show up as 0 on a 
non-initial fragment, with no other indication to the confused end user 
that this is a fragment vs a packet with ports 0 configured (other than 
the mysterious non-matching filter of course :P).

-- 
Richard A Steenbergen <ras at e-gerbil.net>       http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)