Subject: Re: [netatalk-admins] how do you restrict netatalk by ip address?

From: Steven Bonneville <[email-masked]>
Date: Tue, 28 Jul 1998 11:37:56 -0500 (CDT)

John Ostrowick <[email-masked]> wrote:

> i don't know the answer to this but i would like a neat utility to get the
> ip address of the mac that's running the afpd, so i can tell which mac the
> particular user is logged in from :-)
>
[...]
>
> On Tue, 28 Jul 1998 [email-masked] wrote:
>
> > Is there any easy way to restrict netatalk according to the ipaddress?
> > I was trying to use ipfwadm to block a port, but I couldn't specify the
> > protocol (which happens to be ddp) because it said it was unrecognized.

Who says the Mac even *has* an IP address?  As Tony Stuckey pointed out,
DDP is not an IP protocol.  Look at the README file that comes with the
source to see a diagram of the network stack.   DDP and IP both sit on
top of the Ethernet layer.

As far as DDP is concerned, the Mac's network address is the one reported
by nbplkup.  Remember, you don't need to have TCP/IP configured on a Mac
to use the Chooser; only AppleTalk needs to be configured and active.

The ipfwadm utility is for IP firewall administration.  It filters IP
packets.  Right now, you can specify rules for all IP packets, or by
protocol for the TCP, UDP, and ICMP protocols only.  I understand that
eventually ipfwadm will be written to allow filtering of arbitrary IP
protocols besides those three (like EGP, for instance).  But as I
understand it, it doesn't affect DDP packets.

  -- Steve Bonneville

---

From: Mark Donnelly <[email-masked]>
Date: Tue, 28 Jul 1998 12:45:25 -0500

> top of the Ethernet layer.

Quite true!  Hear, hear!

However...

It would take either writing a new utility or re-writing arp, but if you
could grab the given computer's hardware ethernet address (which *MUST* be
transmitted with *EVERY* packet), and then compare that to a list
generated by arp (esp. after pinging the broadcast address), then you
might be able to discover the correct IP address. 

A possible session might be:

[root@yourbox]# atarp -a   #This is for appletalk arp, aarp
Address                 HWtype  HWaddress           Flags Mask    Iface
831.150			eth	00:A0:24:FF:1C:B1   C     *       eth0
831.135			eth	00:A0:24:FF:67:2B   C     *       eth0
831.79			eth	00:A0:24:FF:A4:26   C     *       eth0
831.12			eth	00:A0:24:FF:92:E7   C     *       eth0
[root@yourbox]# ping 10.0.2.0
.
 .
  .
[root@yourbox]# arp -a | grep "00:A0:24:FF:92:E7"
Address                 HWtype  HWaddress           Flags Mask    Iface
10.0.2.1		eth	00:A0:24:FF:92:E7   C     *       eth0

NB: 
    *THIS UTILITY DOES NOT CURRENTLY EXIST!!!!*
    I'm only giving this as a possibility.  This would also necessitate
    a couple of things:
	
	* The computer in question would, as Steven pointed out, have to
	  have its TCP/IP networking turned on.
	* You would need, in all likelyhood, both a kernel patch and a 
	  new utility -- which I called atarp here.

But, if you wrote both of the above, it would be possible to get *some* of
the IP addresses of the clients connecting over DDP.  Some.

FWIW,
--Mark

---

From: Osma Ahvenlampi <[email-masked]>
Date: 29 Jul 1998 11:15:56 +0300

> might be able to discover the correct IP address. 

Routers and bridges between LANs or segments will stop that from working.

-- 
He who hesitates is last. 
Osma Ahvenlampi <[email-masked]>

---

From: Wes Brown <[email-masked]>
Date: Wed, 29 Jul 1998 08:37:51 -0400 (EDT)

> might be able to discover the correct IP address. 

Two problems with that.  Your arp table size must be the size of your local
address space.

Secondly, this would be VERY BAD if you have a network with 256x256
machines like some locations I know of.

Wes
--- 
Wes Brown
[email-masked]		[email-masked]
http://prozac.cwru.edu/wes/About.me.html
KB8TGR