3 ms·
I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which p
by click170 12y ago
I really like this idea. I'm trying to take it one step further in fact.
My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.
- chronomex 12y agoMaybe with VLAN tagging?
- click170 12y agoI like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
- hahainternet 12y agoQinQ
- mobiplayer 12y agoGuys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.
- renaudg 12y agoThe DSCP field is a good candidate for that.
- jethro_tell 12y agoUh set the evilbit as it leaves tue machine and get the gateway to filter it?