Linux Firewalls

Network Layer Responses

Agreeing on definitions for network layer responses is as useful as agreeing on definitions for network layer attacks. Because such responses should not involve information that resides at the transport layer or above, we are limited to the manipulation of network layer headers in one of three ways:

• A filtering operation conducted by a device such as a firewall or router to block the source IP address of an attacker

• Reconfiguration of a routing protocol to deny the ability of an attacker to route packets to an intended target by means of route blackholing—packets are sent into the void and are never heard from again

• Applying thresholding logic to the amount of traffic that is allowed to pass through a firewall or router based ...