topic Re: Portsentry Kill_Route issue in Operating System - HP-UX

Portsentry Kill_Route issue

Bosco Tsang — Fri, 01 Mar 2002 20:37:19 GMT

Portsentry is using the route command to drop off those illegal hosts. However, I've noted that it do not work, as it cannot add the route to a loopback address (127.0.0.1) as follows,

route add host xx.xx.xx.xx 127.0.0.1 1

which will return the error message "Network unreachable". It's the same if I use the actual ip address instead of 127.0.0.1. Why?

Any way for me to enter an invalid gateway etc so portsentry can drop off the traffic?

Re: Portsentry Kill_Route issue

harry d brown jr — Fri, 01 Mar 2002 21:07:49 GMT

Why are you adding a hop count to the host's loopback address? I don't remember if that's correct, but maybe someone else can chime in here?

route add host xx.xx.xx.xx 127.0.0.1 1

live free or die
harry

Re: Portsentry Kill_Route issue

Ron Kinner — Sat, 02 Mar 2002 13:22:40 GMT

Chiming in. The 1 at the end indicates it is not a local address and is, in fact, one hop away. Should be a 0 if it's a local address.

Ron

Re: Portsentry Kill_Route issue

Keith Beckworth — Mon, 04 Aug 2003 18:28:33 GMT

I'm running in to the same issue, but only on hpux 11.x systems. This (route add net 111.222.333.444 netmask 255.255.255.255 127.0.0.1) works corectly on 10.20. From what I've found 11.x tries to verify that the gateway is valid, if it's not then the command fails.

Does anyone know of a way to force the route command to create the staic entry to the loopback?

Re: Portsentry Kill_Route issue

Ron Kinner — Tue, 05 Aug 2003 02:14:46 GMT

ndd -set /dev/ip ip_ire_gw_probe 0

Then if that works you need to put it in /etc/rc.config.d/nddconf so it will stay after a reboot.

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0

Use the next highest integer in the brackets if you already something there.

Ron