RE: Firewall comparison in Data Communications

["Ray Hooker" <rayhook () ibm net>]

A source-routed packet is a packet which has the route information built
into it.  Normally you rely on the route tables in the routers to forward
the traffic from one segment to another.  One of the first ways to
"firewall" is to remove routes.  The idea is that the network would be
unreachable.  Actually the TCP/IP protocol provides for a mean to prespecify
the path the packet will follow in the packet header using the
"source-routing" feature.  For that reason, simply removing routes alone is
not adequate security.

A good firewall should discard source-routed packets.

Ray