Re: Filtering on Ether type, not port

Peter Humphrey <[email protected]>
Newsgroups gmane.comp.security.shorewall
Message-ID <4716620.GXAFRqVoOG@wstn>
Thank you Ruth.

On Wednesday, 2 March 2022 15:29:50 GMT Ruth Ivimey-Cook wrote:
> I wouldn't bother trying to filter on type, just filter on either FB's
> (Mac or IP) address (and possibly dest IP) + port as well.

SW on my LAN server is dropping all incoming packets to port 80, which in this 
case just pollutes the log.

> However, first I would check the manual for the FB and visit the FB
> support to ask how to ask it to stop.

FB just tell me to consult the firewall maker on how to accept EtherType 
0x88e1. That's why I asked here.

> FB have a decent rep and I would be surprised if the behaviour had no useful
> purpose.

Yes, the FB is looking for other web-capable hosts to include in its mesh 
setup. The EtherType 88e1 is looking for Fritz power-line adapters. I don't 
know why these probes only go to the LAN server, not the workstations.

Should I be nervous about opening port 80 to the FB? Won't that just allow 
packets in from the Internet?

-- 
Regards,
Peter.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.