RE: Firewall comparison in Data Communications

[Russ <Russ.Cooper () rc on ca>]

If you want to make "any/all feature/bugs of the Microsoft stack
irrelevant", you need to do more than simply replace TCPIP.SYS. You need
to either implement an NDIS Wrapper or replace/provide an NDIS driver
and tied TCPIP.SYS driver.

Otherwise the NDIS components could accept and forward packets destined
for other protocols (e.g. DLC, NetBEUI, NWLink).

Replacing TCPIP.SYS alone is not enough to make the statement you've
made. If there is a TDI interface from the replacement TCPIP.SYS, then,
possibly, much of NT's "feature/bugs" might be exploitable. An
interesting experiment which I haven't seen reported before might be the
use of TDITrace (from the NT Resource Kit) on boxes that "harden" the MS
TCP/IP implementation (either through replacement or otherwise) to see
just what gets passed.

While some changes are expected in Windows 2000, I've still yet to hear
anyone claim that they'll be able to implement either TCPWrappers or
IPFilter-like functionality on W2K.

Cheers,
Russ - NTBugtraq Editor