Very Computer

For example, I would like to stop udp packets with destination address
239.255.255.250 and port 1900 from being counted as packets affecting the
idle timeout that I have set.

The question boils down to this: how do I code the filter expression so
that these packets are ignored? Is this possible? Or will the firewall
which is already denying them get in the way?

TIA

--
mike

Hi!,

Quote:> I'm very confused as to the use of the active-filter and pass-filter
> options for pppd. The man page doesn't appear to be very explicit about
> how the filters are actually used.

> For example, I would like to stop udp packets with destination address
> 239.255.255.250 and port 1900 from being counted as packets affecting the
> idle timeout that I have set.

> The question boils down to this: how do I code the filter expression so
> that these packets are ignored? Is this possible? Or will the firewall
> which is already denying them get in the way?

See ya

Dean Thompson

--
+____________________________+____________________________________________+

| Bach. Computing (Hons)     | ICQ     - 45191180                         |
| PhD Student                | Office  - <Off-Campus>                     |
| School Comp.Sci & Soft.Eng | Phone   - +61 3 9903 2787 (Gen. Office)    |
| MONASH (Caulfield Campus)  | Fax     - +61 3 9903 1077                  |
| Melbourne, Australia       |                                            |
+----------------------------+--------------------------------------------+

--
Regards, Mike Fry

]On Fri, 21 Dec 2001 01:19:07, Dean Thompson

]> > The question boils down to this: how do I code the filter expression so
]> > that these packets are ignored? Is this possible? Or will the firewall
]> > which is already denying them get in the way?
]>  
]> I remember reading or being told somewhere that these filters are not
]> implemented on any other distribution of PPP other than the BSD version.  As a
]> result, playing around with these filters will only waste your time unless you
]> are using a BSD system.
]>  

]Thanks Dean. Using RH6.2 and that's what all the docs seem to imply. It
]looks like I'm SOL when it comes to using the idle timer to take the PPP
]connection down. These packets come in at fairly random intervals and
]are what are keeping the connection up longer than necessary. Oh well!
]Back to the tried and tested ppp-off method!

The old diald ( which seems to have fallen out of favour since demand
option was configured into pppd) apparently did a much better job of
filtering out such garbage in deciding when the link should go down.
You might find diald again and try that.

You are correct.  The man pages fail abysmally in explaining how the
active-filter option is applied.  Apparently if the filter expression
is true then matching packets do not count against idle time - which
is just the opposite of what one might think.  The meaning in tcpdump
is that if the expression is true then the packet is dumped to standard
output, and otherwise the packet is ignored.  The active-filter analogy
would be that matching packets are counted against idle time, which is
not what happens.

I found that this is the case this morning when I needed something that
would prevent keepalive packets sent by a client on my host from a
certain port to a dynamic DNS server from counting against idle time.
This is what worked for me:

active-filter 'src port pulse'

(pulse is the name I associated with the port number in /etc/services.)

Assuming that the port is at the destination host, this should work
for you:

active-filter 'dst host 239.255.255.250 and dst udp port 1900'

If the firewall is on the destination host then it will get the packets
and if it responds with an "unreachable" or "prohibited" message then
then these responses will count against idle time.  In that case I can
see two avenues of approach.

Try to find a way to use the active-filter, and/or the pass-filter option
to keep the responses from counting against idle time.  I haven't explored
this possibility.

Patch pppd 2.4.1 with the simple patch in the file auth.c.diff-2.4.1.gz
at http://users3.ev1.net/~ckite/public_html/ in the "Files for download"
section so pppd will not count any incoming traffic against idle time.

-- Clifford Kite  <Email: Presently not available>
/* ... packets usually cross many administrative boundaries on their way
   from a source to a destination and often the only point of agreement
   between those separate administrations is that all problems are someone
   else's fault.   --Van Jacobson, abstract of April 97 MSRI talk */

It seems that the active-filter is still not yet ready for prime time.

--
Clifford Kite  <Email: Presently not available>
/*  The generation of random numbers is too important to be left
    to chance.  */