Re: Layer 2 (stealth) firewalls - PBR?

["Paul D. Robertson" <paul () compuwar net>]

On Mon, 7 Apr 2008, Darden, Patrick S. wrote:

> Except that a layer two device can't tell if something is multicast or
> broadcast or unicast or Anything in ipv4 or ipv6....  That's sorta the
> definition of a layer two device.  If it could discriminate amongst
> layer 3 traffic, it would be a layer 3 device--a router, firewall, etc.

I've been doing networking since the broadband/baseband LAN thing a long 
time ago, and I'm pretty cognizant of how it all works...

Layer 2 devices like switches have to forwrd layer 3 multicast packets out 
ports for the multicast group, so they in essence have to peek up a layer 
even though they're not "routers, firewalls, etc."  They also have to 
forward layer 3 broadcasts out all ports in a LAN or VLAN, once again 
without being "routers, firewalls, etc."

Finally, there are alyer 2 broadcasts and layer 2 multicast addresses.  
I'd suggest a Google of "layer 2 multicast addresss" for your increased 
edification, and a good read of the IPv6 RFCs- because if you don't think 
this stuff is going to be where "interesting" attacks and "poor 
implementations" happen...

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul () compuwar net       which may have no basis whatsoever in fact."
             http://www.fluiditgroup.com/blog/pdr/
           Art: http://PaulDRobertson.imagekind.com/

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards