topic Re: How to drop source routed packets? in Operating System - HP-UX

How to drop source routed packets?

Jorge Fabregas — Mon, 24 May 2004 19:12:06 GMT

Hello everyone,

This question if for all network gurus out there! How can I drop source routed packets? In Linux there are some files under the /proc virtual filesystem that allow me to change this.

I've been given a Nessus report regarding this issue on all my servers. I really have no idea how to turn it off on HP-UX.

Thanks in advance,
Jorge

Re: How to drop source routed packets?

Sundar_7 — Mon, 24 May 2004 19:21:48 GMT

If you are running 11.x then you can use ndd. I am not 100% sure if the parameter ip_forward_src_routed can be used to drop the source routed packets.

Check out the ndd documentation and the explanation of ip_forward_src_routed parameter.

Re: How to drop source routed packets?

Steven E. Protter — Mon, 24 May 2004 19:27:46 GMT

ndd is the command. You actually know more about the subject than I, and the ndd manual should lay things out pretty nicely for you.

SEP

Re: How to drop source routed packets?

Ron Kinner — Mon, 24 May 2004 20:45:01 GMT

http://www.blacksheepnetworks.com/security/resources/bastion11.html

is the best source for that sort of info but it assumes you know a lot about ndd. The parameter in ndd is ip_forward_src_routed which is a member of /dev/ip. The default value is 1 but you want it to be 0. There is a file /etc/rc.config.d/nddconf which you have to edit so that it stays after a boot but just to prove the concept you can change it on the fly with:

ndd -set /dev/ip ip_forward_src_routed 0

In the nddconf file you add three lines:

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_forward_src_routed
NDD_VALUE[0]=0

If you already have values in nddconf then use the next higher integer in the brackets.

Ron

Re: How to drop source routed packets?

Jorge Fabregas — Mon, 24 May 2004 20:59:46 GMT

Thanks Sundar, Steven and Ron! Many thanks!

Hey Ron! You made it too easy for me :) Thanks!