Re: Contribute to pf(4)

["Joseph W. Shaw II" <mrman@darkside.org>]

On Tue, 16 Jul 2002, Theo de Raadt wrote:

> > It's in essence a sanity check.  Wouldn't you think something odd was
> > happening if you're seeing traffic from a supposedly unused or reserved
> > network?  It's possible that could be indicative of other issues that
> > should be looked into.  Similar to the theory behind network IDS.
>
> Balony.  It is an utter waste of time.  Don't you guys have something
> better to do?

Balonga or baloney, take your pick.

In essence you're saying blocking possible spoofed traffic is a waste of
time and not an indicator of abnormal network behavior, or am I
misunderstanding you Theo?  That would seem to fly in the face of accepted
network security practices endorsed by just about everyone.  It's
considered a good idea to block RFC1918 reserved address space for public
use, but not other unassigned/reserved space according to you?

I'd love to hear what evidence you have to the contrary.

Regards,
--
Joseph