networking command options

[john guardian]

Just a question. Don't know if this applies to hp-ux. Source-routed packets supposedly allow the packet source to suggest routers forward the packet via a different path than what's configured at the router, in effect bypassing network security.

Is there any way to configure/prevent the application of reverse source routing to TCP responses to source-routed packets in hp-ux? Is it even an issue?

Thx.

[Duncan Edmonstone · Accepted solution]

Not completely sure, but I think

ndd -set /dev/ip ip_forward_src_routed 0

will sort this out...

Add an entry to /etc/rc.config.d/nddconf to make permanent across reboots...

HTH

Duncan

[Matti_Kurkela]

IP source routing is more of a router-level issue. If your routers are configured to block source-routed traffic or to remove source routing options from any passing traffic and behave as if those options didn't exist, you should be reasonably safe.

Duncan's advice applies if your HP-UX system is acting as a router.

As far as I know, the source routing feature in the TCP/IP protocol has never had any wide-spread legitimate use. It may have had some use with the earliest IP networks, but once TCP/IP was widely established, it quickly became obvious that source routing was a bad idea.

MK