Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working through the security guide from apple (which they did not update since Snow Leopard). In the firewall section it states that ipfw has a default allow rule:

65535 allow ip from any to any

And if you enable the firewalls 'stealth mode' via the settings the following rule should be added:

33300 deny icmp from any to me in icmptypes 8

The funny thing is: I have stealth enabled and I do not see this rule when doing

sudo ipfw print

Any idea where stealth mode is enforced if not in the ipfw ruleset?

share|improve this question
up vote 2 down vote accepted

Recent versions of OS X use primarily use the application firewall, not ipfw. In the app firewall, you can enable stealth mode with the command:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Note that this only takes effect if the app firewall is running. To enable it from the command line, use:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
share|improve this answer
Thanks! Do you have any resources at hand that describe the socketfilterfw in more detail? – er4z0r Oct 9 '12 at 20:03
There doesn't seem to be much documentation, although google will point you at various people's experimentation & results. For the socketfilterfw command itself, /usr/libexec/ApplicationFirewall/socketfilterfw -h is the best resource I know. – Gordon Davisson Oct 10 '12 at 2:34
Played around with that. Thx. – er4z0r Oct 12 '12 at 8:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.