Re: nmap fun

[mjr () nfr com (Marcus J. Ranum)]

Bret Watson <lists () ticm com> asks:
> Thusly, one can do a TCP Connect scan of an address space covered by 
> Gauntlet and get all the machines with their open ports - scary huh?

I don't think there are any pure proxy firewalls left
in the world; most of the modern ones implement some kind
of filtering capability "underneath" the proxying layer.
This leaves them open to many of the questions a packet
screen has to answer: does it track state (really, not just SYN/ACK)
etc. I don't know anything about the way in which the newer
versions of proxy firewalls implement transparency, but
my suspicion is that a number of the implementations are
flawed; in retrospect, there may be all kind of ways a
packet can get through.

Firewall customers once had a vote, and voted in favor
of transparency, performance, and convenience instead
of security; nobody should be surprised by the results.

mjr.

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards