Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

24

|

Chapter 2: Designing Perimeter Networks

Stateful packet filtering

At its simplest, the tracking of TCP sessions: using packets’ TCP header

information to determine which packets belong to which transactions, and thus

filtering more effectively. At its most sophisticated, stateful packet filtering refers

to the tracking of not only TCP headers, but also some amount of application-

layer information (e.g., end-user commands) for each session being inspected.

Linux’s iptables include modules that can statefully track most kinds of TCP

transactions and even some UDP transactions.

TCP/IP stack attack

A network attack that exploits vulnerabilities in its target’s TCP/IP stack (kernel-

code or drivers). These are, by definition, OS specific: Windows systems, for

example, tend to be vulnerable to different stack attacks than Linux systems.

With the exceptions of “stealth scanning” and of TCP-sequence-number attacks

(used in IP spoofing), stack attacks are becoming less common.

That’s a lot of jargon, but it’s useful jargon (useful enough, in fact, to make sense of

the majority of firewall vendors’ propaganda!). Now we’re ready to dig into DMZ

architecture.

Types of Firewall and DMZ Architectures

In the world of expensive commercial firewalls (the world in which I earn my living),

the term “firewall” ...