Re: strange results with pf

["Alexei G. Malinin" <mag@ecom-it.ru>]

Daniel Hartmeier wrote:

>On Wed, Aug 20, 2003 at 01:26:35PM +0400, Alexei G. Malinin wrote:
>
>  
>
>>The talk is about all protocols (not only tcp) and protocol scanning by
>>nmap.
>>    
>>
>
>Make sure you are scanning from a separate host. Running nmap on the
>firewall itself (against one of its own addresses or another host) will
>cause EHOSTUNREACH errors from the stack when pf blocks outgoing
>packets (like, when you allow only flags S/SA to create state and block
>by default, but nmap tries to send ACK, SYN+ACK or xmas flags).
>
>Daniel
>
>  
>
I scanned from separate host.

-- 
Alexei Malinin,
Chief Specialist of
Network Technologies Department,
ECom-IT Limited,  Moscow
Basic Element Inc.,  Russia