Security
Logical ANDing
When a packet is compared (in most cases) a logical AND is performed. First the IP addresses and subnet masks are converted to binary and then ANDed together. The rules for logical ANDing are as follows:
0 AND 0 = 0 |
|
|
0 AND 1 = 0 |
|
|
1 AND 0 = 0 |
|
|
1 AND 1 = 1 |
|
|
For example: |
|
|
Filter rule: |
|
|
Deny |
|
|
IP: 163.176.1.15 | BINARY: | 10100011.10110000.00000001.00001111 |
Mask: 255.255.255.255 | BINARY: 11111111.11111111.11111111.11111111 | |
Incoming Packet: |
|
|
IP 163.176.1.15 | BINARY: | 10100011.10110000.00000001.00001111 |
AND the incoming packet and subnet mask together, the result is:
10100011.10110000.00000001.00001111
which matches the IP address in the filter rule and the packet is denied.
Implied Rules
With a given set of filter rules, there is an Implied rule which may or may not be shown to the user. The implied rule tells the filter set what to do with a packet that does not match any of the filter rules. An example of implied rules is as follows:
Implied | Meaning |
|
|
Y+Y+Y=N | If all filter rules are YES, the implied is NO. |
|
|
N+N+N=Y | If all filter rules are NO, the implied is YES. |
|
|
Y+N+Y=N | If a mix of YES and NO filters, the implied is NO. |
|
|
Established Connections
The TCP header contains one bit called the ACK Bit (or TCP Ack bit). This ACK Bit only appears with TCP, not UDP. The ACK bit is part of the TCP mechanism that guaranteed the delivery of data. The ACK bit is set whenever one side of a connection has received data from the other side. Only the first TCP packet will not have the ACK bit set, once the TCP connection is in place the remainder of the TCP packets with have the ACK bit set.
The ACK bit is helpful for firewall design and reduces the number of potential filter rules. A filter rule could be created just allowing incoming TCP packets with the ACK bit set, as these packets had to be originated from the local network.
