Re: Re: [Ebtables-user] bridge/ebtables interaction...
Stephen Hemminger <[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.devel |
|---|---|
| Organization | Open Source Development Lab |
| Message-ID | <[email protected]> |
On Tue, 24 May 2005 18:26:00 -0400 Jon Anderson <janderson-PLjm5N+tXOMV+D8aMU/[email protected]> wrote: > Stephen Hemminger wrote: > > >That implies a bad bridge topology (not tree), so that can't be legal. > >There can be only one (active) path to another node or the possiblities > >of loops exist and bridging won't work! > > > > > Bad bridge topology...or a hostile user. A user with physical access and > the ability to change his/her mac address can bring down a network > simply by snagging a MAC and sending packets through the bridge. > Then how do you propose to stop them? One way that makes sense is to drop the offending packets and defer the update of the forwarding database until after the prerouting hook. That assumes that no routing hook rewrites the source address, but that shouldn't be that hard. Is that what you already proposed? ------------------------------------------------------- This SF.Net email is sponsored by Yahoo. Introducing Yahoo! Search Developer Network - Create apps using Yahoo! Search APIs Find out how you can build Yahoo! directly into your own Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005