There is an offending host which keeps sending me packets every second or so. The ruleset used to block it and log it accordingly. I have logging configured through the syslog facility - "log first level local2.info". However, since the offending host is filling up the log file, I just want to drop the packet(s) without logging the event(s).
Therefore, as a test, I put in as the very first line in ipf.conf: block in quick on qe0 ttl 10 from <offending host's IP>/32 to any keep state but it still shows up in the firewall's log file: Apr 23 09:01:16 firewall ipmon[105]: 09:01:15.236653 2x qe0 @0:18 b x.x.x.x,67 -> 255.255.255.255,68 PR udp len 20 N 1. the rule is at the very top in ipf.conf, and I use "quick" on all my rules save the last one, so why is there "@0:18"? 2. why is it still logging the drop? 3. how do I configure it properly, so it doesn't log any more packets from that host?
