pktfilter-users — General mailing list for posts concerning PktFilter

[pktfilter-users] Blocking specific packets

[Argcyborg <arg...@gm...>]

Hi all, there´s a way to block/drop an specific packet ¿?

For instance, if I need to drop/block a packet with a specific string on it
like “this is the string to filter”, can be done with pktfilter ?

 

Thanks in advance

Best regards!

[pktfilter-users] link

[Kostas <kpe...@ya...>]

    
http://www.racing7.es/lxhgjiiq/knvnzfbaizpnmd

[pktfilter-users] writing a rule

[<sc...@ro...>]

Hi!Could someone help me achieving this with pktfilter?
I want to block an outbound connection and allow all others inbound and
outbound?

The connection I want to block is

block from local port 30 UDP to remote ip 10.10.10.15 on port 40000 UDP
allow everything else

What should be the content of the rules.txt file?
Thanks:scuzi

[pktfilter-users] Port 0

[Spora <sp...@em...>]

Hot to do to block "port = 0" ?

[pktfilter-users] redirect to web page

[Aulia CS <aul...@ya...>]

i
have read your pktfilter manual. there is one question about pktfilter.
can i redirect blocked IP address to web page? how can i do it?

in this case, i use block function for default rule. and these are my default rule:

block in on eth0 all
block out on eth0 all

thanks for your attention



      Lebih aman saat online. Upgrade ke Internet Explorer 8 baru dan lebih cepat yang dioptimalkan untuk Yahoo! agar Anda merasa lebih aman. Gratis. Dapatkan IE8 di sini! 
http://downloads.yahoo.com/id/internetexplorer/

[pktfilter-users] use pktfilter with dns

[Aulia CS <aul...@ya...>]

hallo every one,,, 

in pktfilter doc, i just see block or pass client with their ipaddress. can i change the ipaddress destination or source with DNS??

thanks..



      Lebih aman saat online. Upgrade ke Internet Explorer 8 baru dan lebih cepat yang dioptimalkan untuk Yahoo! agar Anda merasa lebih aman. Gratis. Dapatkan IE8 di sini! 
http://downloads.yahoo.com/id/internetexplorer/

[pktfilter-users] IP range

[Kovács I. <kv...@ci...>]

 Can I use Ip ranges in my RULES.TXT file?

[pktfilter-users] pktfilter etho and eth1

[Richard J. <rj...@fi...>]

Hi folks,
 
Has anyone ever seen the scenario where eth0 and eth1 switch on network cards ? We just recently ran into this using pktfilter on a windows 2003 server. It seems odd, wondering if someone has seen this and or knows of a fix.

	Richard Jarvis
Director NM - FitLinxx, Inc.
The technology company whose products motivate people to live more active and healthy lifestyles!
www.fitlinxx.com     www.actihealth.com

	542 Westport Ave 
Norwalk, CT 06851
p. 203.708.5103    f. 203.316.5150

Norwalk CT     Southborough MA     Hampshire UK     Ridderkerk NL

	 

 

[pktfilter-users] Forwarding packets between two interfaces on the same machine

[Kostas P. <kpe...@ya...>]

Hi all,

I was looking for a windows "iptables"-like application.  With great pleasure I fould PktFilter, which is free and includes functionality similar to the one of iptables.  

However, what I need to do includes some NAT functionality.  In fact, in a high level, I want to share the 3G connection of my laptop through its wifi interface with the other machines of my home network.  In order to do so I could use iptables with linux in order to define forwarding rules between the two different interfaces on the laptop.  From what I saw, this is not possible with PktFilter and Windows.  Is this right? If (for my own bad luck :) ) this is true, are you aware of any other Windows tool that it might be useful for my purposes?

Thanks a lot for your time  


      

[pktfilter-users] how to delete rule without index number?

[Aulia CS <aul...@ya...>]

hello,,,good night every one.

there are two questions about using pktfilter :

1.any body now how to delete rule just with rule it self, no with index number? 

2. how to select the device that we will filter? 

thanks for every think,,,,



      Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya sekarang! http://id.mail.yahoo.com

[pktfilter-users] White House news conference.

[Carlton D. <loi...@ax...>]

We are living in a time of natural resources , and those with the
natural resources  are those with the power and money.
gold, oil, property; all at record highs.  It's where you need to be.
Our next feature has achieve that position, and is now
starting heavy weight promotion to let anyone know it.

This company is none other than AUNI.  AUNI is specialized
in natural resources  ventures.  An incredible breakthrough is
coming out of the company and will be backed up with a
smashing publicity blitz.

---
AUNI . OB
Cap: 92.85M
---

After a slight pullback on Wednesday, we are certain to see
a boost of over 300% over the next week.  There is no
reason you should refuse yourself to benefit from a big
break.  Don't let this one pass by.

[pktfilter-users] A simple and safe way to we-igh less

[Mike M. <raw...@ti...>]

Even if getting thin`ner is not on your to do list at the moment, Ana_trim can help you
optimize your eating and feel better than any time before! This advanced
blend of nat/ural ingredients puts your body in real control over what
you eat, suppressing excessive ap-petite and giving you plenty of natural
bodily energy. And of course it does help in shedding we`ight, too!

Check out Ana/trim, and you'll join the worldwide community of millions
of happy customers who are making their life better and more enjoyable
right now. Les/s eating frenzy, les_s lbs and more fun in life!

CIick he/re to see our unbeatable Ana_trim deals:
http://www.kols.st/









Re+move y~ur e_mail:
http://www.kols.st/u.php

Re: [pktfilter-users] Nice to see Amoxil you.

[JAMES A C. <ach...@ne...>]

Hi
yours will always talk first and shoot later.And 
You can buy Buspar (Buspar 10mg)
cheapes on internet.
(Do not click. Select domain and press Ctrl+C. After that - Ctrl+V in =
browser)
Type kahuituidesin.com
again.For the first time in a lifetime of verbal 
 
dropped so I couldnt hear his words, strain as I might. 
 
There was a saccharine wheedle and whine in his voice, 
 
 

[pktfilter-users] Weighty message. You have to read.

[Whitney F. <uiq...@ba...>]

------------------------------------
Company name: Texhoma Energy, Inc.
Stock symbol: TXHE.PK
Current price: 0.12 (up 50% this week)
Expected price 10/20/2006: 0.52
------------------------------------


The information mentioned herein has not been released to the
general public and should be kept confidential until its
scheduled announcement on Friday, October 20.  I strongly suggest
that you get in before then.

HOUSTON, TEXAS--(MARKET WIRE)--October 20, 2006 -- Texhoma Energy,
Inc. [TXHE] is pleased to announce Successful drilling results on
the Clovely site.  As mentioned in earlier updates we encountered
two expansive gas pockets with a flow rate estimated at 900 MCF
of gas per day.  Today we are happy to report the discovery of an
oil reservoir which has far exceeded our initial expectations.
Recoverable reserves are estimated at 2mil barrels and plans are
in place to start additional drilling in order to take advantage
of this very fortunate situation.  As always, we will keep our
shareholders abreast of the latest happenings.

With offices in Houston, Texhoma Energy Inc. is a junior
international oil and gas company focused on acquiring,
developing and producing oil and gas. The Company is currently
active in the southern United States.

The Company's principal geographic area of focus lies in the
wider Gulf of Mexico petroleum basin, which includes onshore and
in-shore opportunities. The Company participates in a selected
number of oil and gas ventures through judgment by a small team
of experienced professionals.  Recently these experts have had a
string of successes which will be reflected in upcoming revenue
reports.

Revenue from production is estimated to be worth $120mil.  With
177mil shrs outstanding this gives us a book value of 0.67

This is a great opportunity for you to make the market work for
you. After 10/20/2006 the price will increase significantly.

[pktfilter-users] logging in Windows XP with SP2 is OK now!

[cookiefj <coo...@16...>]

Based on my debugging, the value of threshold should be big enough when calling PfSetLogBuffer(buf, buf_size, threshold, enteries,...), e.g. half of buf_size would be ok.
 
Second, buffer must be quad-word aligned:

 log_buf = malloc(log_buf_size * sizeof(char) + 0xf);
 if (log_buf) {
  log_buf = (char *)((int)(log_buf + 0xf) & (~0xf));
  memset(log_buf, 0, log_buf_size);
......

 
Then logging in Windows XP with SP2 would be OK!
 

[pktfilter-users] PktFilter and command line interface

[Kyver <ky...@cy...>]

Hello all
I have installed PktFilter on a new install of windows 2000 sp4
I am trying to make a web interface to be able to add/delete rules but there
is a problem..

"error: unable to read from \\.\pipe\PktFltPipe"

This occurs when the Web Server (Microsoft IIS) executes "pktctl.exe -l
eth0" to list the rules on eth0.
I can do the same command in a command prompt and it lists the results just
fine.
The web server is using the local administrator account so it shouldn't be a
permissions problem.
Other programs (such as ipconfig) display the results just fine in the web
page.
As I am not familiar with C, Im hoping someone here can point me in the
right direction.
Terry

[pktfilter-users] how can i ?

[spitfir33 <cs...@fd...>]

I want to know if pktfilter can make this:

I want to filter packets with udp port 27015 destination for a line that =
can make a server crash ... and if that packet contains that line i want =
Pktfilter to drop it, if not to allow that packet ... i have tried to =
make this with snort but snort can only log the exploit attempts... i =
want to block this attempts

Can Pktfilter do this ?.... and how ?

In Linux is very simple but in win ..... :) ... pls help ? :)

Re: [pktfilter-users] Re: pktfilter-users digest, Vol 1 #102 - 1 msg

[<su...@us...>]

>=20
> Hi :
>=20
> Can we block netbios(workstation name) name with pktfilter ?
>=20

block in on eth0 proto udp from any to any port 137
block in on eth0 proto tcp from any to any port 137
block in on lo0 proto udp from any to any port 137
block in on lo0 proto tcp from any to any port 137

I use this to block all netbios and dcom/RPC ports:
block in on eth0 proto udp from any to any port 134 >< 140
block in on eth0 proto tcp from any to any port 134 >< 140
block in on lo0 proto udp from any to any port 134 >< 140
block in on lo0 proto tcp from any to any port 134 >< 140
block in on eth0 proto udp from any to any port =3D 69
block in on eth0 proto tcp from any to any port =3D 69
block in on lo0 proto udp from any to any port =3D 69
block in on lo0 proto tcp from any to any port =3D 69
block in on eth0 proto udp from any to any port =3D 111
block in on eth0 proto tcp from any to any port =3D 111
block in on lo0 proto udp from any to any port =3D 111
block in on lo0 proto tcp from any to any port =3D 111
block in on eth0 proto udp from any to any port =3D 445
block in on eth0 proto tcp from any to any port =3D 445
block in on lo0 proto udp from any to any port =3D 445
block in on lo0 proto tcp from any to any port =3D 445
block in on eth0 proto udp from any to any port =3D 593
block in on eth0 proto tcp from any to any port =3D 593
block in on lo0 proto udp from any to any port =3D 593
block in on lo0 proto tcp from any to any port =3D 593


--=20
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/

[pktfilter-users] Re: pktfilter-users digest, Vol 1 #102 - 1 msg

[<zw...@gm...>]

Hi :

Can we block netbios(workstation name) name with pktfilter ?




On 11/29/05, pkt...@li... <
pkt...@li...> wrote:
>
> Send pktfilter-users mailing list submissions to
>        pkt...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
>        https://lists.sourceforge.net/lists/listinfo/pktfilter-users
> or, via email, send a message with subject or body 'help' to
>        pkt...@li...
>
> You can reach the person managing the list at
>        pkt...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of pktfilter-users digest..."
>
>
> Today's Topics:
>
>   1. Windows port of OpenBSD Packet Filter (Jean-Baptiste Marchand
> (lists))
>
> --__--__--
>
> Message: 1
> Date: Tue, 29 Nov 2005 13:37:28 +0100
> From: "Jean-Baptiste Marchand (lists)" <jbm...@gm...>
> To: pkt...@li...
> Subject: [pktfilter-users] Windows port of OpenBSD Packet Filter
>
> Hello,
>
> I thought that some of you might be interested in the beta software
> recently released by CORE that includes a Windows port of OpenBSD's
> Packet Filter (PF):
>
> http://force.coresecurity.com/index.php
>
> http://www.securityfocus.com/archive/1/417965
>
>
> http://force.coresecurity.com/index.php?module=3Darticles&func=3Ddisplay&=
ptid=3D10&catid=3D39&aid=3D16
>
> From what I read, CORE Force includes two drivers, an NDIS miniport
> driver and a TDI driver, to implement network filtering at the various
> levels of Windows TCP/IP stack.
>
> Jean-Baptiste Marchand
>
>
>
> --__--__--
>
> _______________________________________________
> pktfilter-users mailing list
> pkt...@li...
> https://lists.sourceforge.net/lists/listinfo/pktfilter-users
>
>
> End of pktfilter-users Digest
>

[pktfilter-users] Windows port of OpenBSD Packet Filter

[Jean-Baptiste M. (lists) <jbm...@gm...>]

Hello,

I thought that some of you might be interested in the beta software
recently released by CORE that includes a Windows port of OpenBSD's
Packet Filter (PF):

http://force.coresecurity.com/index.php

http://www.securityfocus.com/archive/1/417965

http://force.coresecurity.com/index.php?module=articles&func=display&ptid=10&catid=39&aid=16

From what I read, CORE Force includes two drivers, an NDIS miniport
driver and a TDI driver, to implement network filtering at the various
levels of Windows TCP/IP stack.

Jean-Baptiste Marchand

Re: [pktfilter-users] NetCenturion 1.2.0.4 now available

[Jean-Baptiste M. <jbm...@gm...>]

On 11/11/05, Hallstein <hal...@ui...> wrote:

> I would like to inform you all that  NetCenturion version 1.2.0.4 now
> available.

[...]

> Download at: http://www.softsystem.co.uk/page5.html
>
> I would like to point out that the author of pktfilter pointed at
> NetCenturion, since he no longer develop pktfilter. pktfilter was last
> updated February 12, 2003.

Thank you Hallstein for announcing the new release of NetCenturion.

Given that I not longer maintain PktFilter, I can only recommend
people to look at the new version of NetCenturion.

By the way, people looking for an IP filtering solution on Windows
systems might be interested by the following article:

http://www.microsoft.com/technet/community/columns/cableguy/cg0605.mspx

Jean-Baptiste Marchand

[pktfilter-users] NetCenturion 1.2.0.4 now available

[Hallstein <hal...@ui...>]

A side note;

I would like to inform you all that  NetCenturion version 1.2.0.4 now 
available.

"NetCenturion is a TCP/IP packet filter for Windows 2000 and XP that 
protects your computer from unauthorised access and attacks while 
connected to the public Internet. NetCenturion can make your computer 
appear invisible from the Internet and can protect vulnerable Windows 
services such as file sharing.  It does all this while you continue to 
enjoy uninterrupted web browsing, e-mail, downloading and other Internet 
activities.

NetCenturion is open source.  It may be freely used by any individual 
for personal or private use or for their business without any 
restriction or charge.  Companies, organisations or governments may not 
use it without a license.  In no case may NetCenturion be used to 
deprive anyone of life, liberty or livelihood."

Download at: http://www.softsystem.co.uk/page5.html

I would like to point out that the author of pktfilter pointed at 
NetCenturion, since he no longer develop pktfilter. pktfilter was last 
updated February 12, 2003.

For all of you moving to Windows XP SP2 firewall, I would like to hear 
about your experiences.

Hallstein

[pktfilter-users] It does not work on a bridge

[Unspecified <fa...@ho...>]

I need some help on understanding this problem. I have three network cards,
and two of them are linked in a bridge. I need to filter the packets going
through that bridge, and the packet filter completely ignores any packet
whose mac addresses are not coming or going to the mac address assigned to
the bridge itself. How do I force the software to filter all packets flowing
through?

Federico (fa...@ho...)

re: [pktfilter-users] a problem about PktFilter usage

[<su...@us...>]

 > I want to know if I want to forbid the computer to
 > send any data to to some special port of any ip(such
 > as special Destination Port:6890 ~6891), what I should
 > do is:
 >=20
 > block out on eth0 proto tcp to any port 6890 ^>^< 6900
 >=20
 >=20
 > Thanks
 > Benben
 >=20


block out on eth0 proto tcp from any to any port 6890 >< 6900
block out on eth0 proto udp from any to any port 6890 >< 6900

This should block traffic from any local port to remote port range 6891 to =
6899.




--=20
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/

[pktfilter-users] a problem about PktFilter usage

[Benben <ben...@ya...>]

Hi all:
   I get to know PktFilter today. I read the
pktfilter.pdf included in the install-package, and I
find :
1)Source port (TCP and UDP)
 port comparator decnumber, where decnumber is the
source port
number and comparator, one of the following:
 =
 >=
 >
 <=
 <
 port low_port >< high_port, where low_port is the
immediately lower port of the interval and high_port
is the immediately higher port of the interval.

2)Destination Port (TCP and UDP)

I want to know if I want to forbid the computer to
send any data to to some special port of any ip(such
as special Destination Port:6890 ~6891), what I should
do is:

block out on eth0 proto tcp to any port 6890 ^>^< 6900


Thanks
Benben



	

	
		
___________________________________________________________ 
雅虎免费G邮箱－中国第一绝无垃圾邮件骚扰超大邮箱 
http://cn.mail.yahoo.com