📄 00000005.htm
字号:
<HTML><HEAD> <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>发信人: zixia (Do you zixia tonight), 信区: Linux <BR>标 题: 3. So What's A Packet Filter? <BR>发信站: BBS 水木清华站 (Wed Oct 11 01:17:06 2000) WWW-POST <BR> <BR> Linux 2.4 Packet Filtering HOWTO: So What's A Packet Filter? (p1 of <BR>3)
<BR>
<BR>
<BR>
<BR>
<BR>3. So What's A Packet Filter?
<BR>
<BR> A packet filter is a piece of software which looks at the header of
<BR> packets as they pass through, and decides the fate of the entire packet.
<BR> It might decide to DROP the packet (i.e., discard the packet as if it had
<BR> never received it), ACCEPT the packet (i.e., let the packet go through),
<BR> or something more complicated.
<BR>
<BR>LinUnder Linux, packet filtering is built into the kernel (as a kernelhere a <BR>Ma
<BR> module, or built right in), and there are a few trickier things we can do
<BR> with packets, but the general principle of looking at the headers and
<BR> deciding the fate of the packet is still there.-------------------------
<BR>
<BR>3.1 Why Would I Want to Packet Filter?there a Mailing List?
<BR>
<BR> Control. Security. Watchfulness.
<BR> * Thanks to Filewatcher.
<BR> Control:ks to The Samba Team and SGI.
<BR> * Thanks to Jim Pick.
<BR> when you are using a Linux box to connect your internal network <BR>to
<BR> For the another network (say, the Internet) you have an opportunity to
<BR> allow certain types of traffic, and disallow others. For example,
<BR> ------the header of a packet contains the destination address of the--
<BR> packet, so you can prevent packets going to a certain part of the
<BR> Next Preoutside network. As another example, I use Netscape to access the
<BR> Dilbert archives. There are advertisements from doubleclick.net <BR>on
<BR> the page, and Netscape wastes my time by cheerfully downloading
<BR> them. Telling the packet filter not to allow any packets to or
<BR> from the addresses owned by doubleclick.net solves that problem
<BR> (there are better ways of doing this though: see Junkbuster).
<BR>
<BR> Security:
<BR>
<BR> when your Linux box is the only thing between the chaos of the
<BR> Internet and your nice, orderly network, it's nice to know you <BR>can
<BR> restrict what comes tromping in your door. For example, you might
<BR> allow anything to go out from your network, but you might be
<BR> worried about the well-known `Ping of Death' coming in <BR>from
<BR>LinUnder Limalicious outsiders. As another example, you might not wanthere a <BR>Ma
<BR> mo outsiders telnetting to your Linux box, even though all your o
<BR> with pacaccounts have passwords. Maybe you want (like most people) to be
<BR> an observer on the Internet, and not a server (willing or-------
<BR> otherwise). Simply don't let anyone connect in, by having the
<BR>3.1 packet filter reject incoming packets used to set up connections.
<BR>
<BR> Watchfulness:
<BR>
<BR> sometimes a badly configured machine on the local network will
<BR> decide to spew packets to the outside world. It's nice to tell <BR>the
<BR> packet filter to let you know if anything abnormal occurs; <BR>maybeto
<BR>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -