Broadcast packets not blocked by filter ?!?

[Skybuck Flying]

Hello,

I banned ip address: 7.0.79.54 in windows xp policy etc...

(This is a virtual ip)

To my surprise the broadcast packets are not blocked ?

(Only unicast packets are blocked ?!?)

So for example udp packet:

Source IP: 7.0.79.54
Dest IP: 255.255.255.255

^^^ Is not blocked.

While

Source IP: 7.0.79.54
Dest IP: My IP

^^^ Is blocked ?!?!?

I guess I have to add a special rule for broadcast packets ?!

Hmm...

Gonna try it...

Later,
Bye,
Skybuck.

 

[Skybuck Flying]

So far I base the rules on "destination addres/ip".

Before I try a special broadcast rule....

First I try a "source address/ip" rule...

Maybe that will work for banning broadcast packets too...

Bye,
Skybuck.

 

[Skybuck Flying]

Nope that doesn't seem to work.

I choose filter option "block".

Instead of the "request security".

(Maybe block don't work ? but unicast it does seem to block so this is
weird).

Maybe this is a broadcast bug in the filter ?!?

Now I am gonna try a special broacast rule.

Bye,
Skybuck.

 

[Skybuck Flying]

Hmm weird... the source rule disappeared gonna try again first

Bye,
Skybuck.

 

[Skybuck Flying]

Maybe it got removed because it was invalid or conflicting...

I tried again... this time it worked for the broadcast packets...

But unicast both ways blocked not...

So I would have to add a special rule to block unicast in both ways...

This kinda sux because it requires two rules... which is double as much work
but ok.

Also trying to ban 255.255.255.255 for a specific source is not possible...

So I had to choose "any ip" which is a bit strange but ok

End result:

Broadcast packets banned for ip X
Unicast packets banned for ip X both ways.

However I also noticed something weird:

The broadcast packets were still showing up in the wireshark sniffer...

Apperently broadcast packets follow a different route through the windows
filter/firewall/policy logic ?!?!?

^ Weird... might be exploitable too ^ For example "broadcast attacks on
VPLAN's" might still work.

Bye,
Skybuck.

 

[Frank Holman]

You get a woody talking to yourself??