Hello everyone. It is my first post on this mailinglist. As we know in FreeBSD there is the pseudo random number generator (PRNG) for random IP fragmentation ID. It is available when "net.inet.ip.random_id" sysctl variable is set to 1 (default 0). I would like to know, which algorithm (X2, X3 or A0 or another one) is used in FreeBSD 8.1-RELEASE or better in 8 branch? Which algorithm is used in FreeBSD for packet filtering (IP packet normalization, or e.g. scrub on $ext_if ... random-id for the PF ruleset), pfsync interface protocol and (if the kernel flag "net.inet.ip.random_id" is set to 1) for "regular" IP traffic (with TCP/UDP), IP multicast routing... etc? Best regards!
Hello, Sorry, but link and images are unreached for me, so I do not have chance to review it. It seems that OpenDNS is blocking this site, probably due to some enabled filters. Best regards! 2011/9/3, freebsd-security@freebsd.org <freebsd-security@freebsd.org>:> I am out of office right now and will get back to you when I return. If you > don't hear from me, my assistant should contact you shortly. I wish I were > as lucky as the people who work with this work at home company, you should > check them out..Click Here > > Enable images or click here > > Let me know what you think after you have a chance to review. > Cheers! > > If you no longer wish to receive emails, please unsubscribe > > 866-288-1880 > 5150 yarmouth ave, Encino, CA 91316 > On Sat, 3 Sep 2011 19:32:37 +0200, ian ivy wrote: >
On Sun, 4 Sep 2011 18:04:37 +0200 ian ivy wrote:> Hello, > Sorry, but link and images are unreached for me, so > I do not have chance to review it. It seems that OpenDNS > is blocking this site, probably due to some enabled filters.You replied to a spam.
Hello Ian Sorry, that I can not help on your initial question, but something with the e-mail you got is very strange. On 04.09.2011 19:19, RW wrote:> On Sun, 4 Sep 2011 18:04:37 +0200 > ian ivy wrote: > >> Hello, >> Sorry, but link and images are unreached for me, so >> I do not have chance to review it. It seems that OpenDNS >> is blocking this site, probably due to some enabled filters. > > You replied to a spam.At first, it looks like an ordinary out of office message, but then it is more then a spam or something else which tries to trick the reader into clicking an URL, which eventually could hurt your computer. The answer you received had only be sent to you and not to the whole mailing list. It is strange, that it has the sender set to freebsd-security@freebsd.org. Do you see some other e-mail address (or hostname / IP address) in the header lines of the e-mail? Or do you see the URL where the "click here" is pointing to (better do not click on them)? If you could provide the details, then this "fake" subscriber can probably be removed and blocked by the list admins. It looks like this has some system, as I found the same question about this e-mail in archives of other mailing lists, eg. [1], [2] (several in the left pane) and [3] (even on full-disclosure, with faked sender address of the original sender). [1] http://www.mail-archive.com/django-users@googlegroups.com/msg125720.html [2] http://markmail.org/message/z2lxq5mf35cgow5l [3] http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082161.html bye Fabian
Hello Just for your information. On 04.09.2011 23:00, Fabian Wenk wrote:> Do you see some other e-mail address (or hostname / IP address) in > the header lines of the e-mail? Or do you see the URL where the > "click here" is pointing to (better do not click on them)?Ian had answered privately to me with the details. According to it, this e-mail tries to trick the reader into clicking a link (if the image is not visible, which would be loaded from a remote URL) to probably verify the e-mail address of the receiver. Luckily the URLs are (probably wrongfully) pointing to click.freebsd.org which does not exists. The e-mail use a faked sender address which is set to freebsd-security@freebsd.org, but according to the header lines the e-mail was not sent from a system belonging to the FreeBSD project. I have sent an e-mail with all the details to the admins of the mailing list, as I suspect we have a rouge subscriber in the list. bye Fabian
Hello On 06.09.2011 12:57, Fabian Wenk wrote:> I have sent an e-mail with all the details to the admins of the > mailing list, as I suspect we have a rouge subscriber in the list.Is is a bad idea only to trust the spell correction for a foreign language, obviously it should be "rogue" instead of "rouge". :) bye Fabian