Re: stealth ports and IDS

[Kevin Steves <stevesk () pobox com>]

On Thu, Oct 03, 2002 at 10:59:29AM -0400, Anton A. Chuvakin wrote:
> > address or stack. I do not know of a way of acheiving this using linux
> > or netBSD etc.. and without it I would feel rather vulnerable. To help
> Well, in Linux its really simple:
>
> ifconfig eth1 up
>
> with enable the interface with no IP. Just use the snort with "snort -i
> eth1" and you are in action.

A 0 addr up interface may transmit.  I know OpenBSD will currently
respond to ARP requests for 0.0.0.0 in this case; NetBSD should not
(from my examination of the source).  And there may be other transmit
cases for a 0.0.0.0 up interface (I suspect there probably are)
depending on OS.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards