Re: Firewalls that generate new packets..

["Marcus J. Ranum" <mjr () ranum com>]

jdgorin () computer org wrote:
> I also remember that early Checkpoint firewalls broke FTP connection if the PORT
> command and the PORT arguments were sent in differents packets (back in those
> old times, some FTP gateway did that kind of tricks).
> That was deep but not smart inspection!

That was a side effect of the fact that they didn't do TCP reassembly,
packet defragmentation, or re-ordering. I always figured that they were
just doing a case-independent compare for "PORT " at the beginning
of the packet data.

Heck of a "state" engine, huh?

mjr. 

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards