There is an offending host which keeps sending me packets every second or so. The ruleset used to block it and log it accordingly. I have logging configured through the syslog facility - "log first level local2.info". However, since the offending host is filling up the log file, I just want to drop the packet(s) without logging the event(s).
Therefore, as a test, I put in as the very first line in ipf.conf:
block in quick on qe0 ttl 10 from <offending host's IP>/32 to any keep state
Did you restart ipf? Why did you say 'ttl 10'? You shouldn't see traffic to 255.255.255.255 except from hosts on your immediate network.
but it still shows up in the firewall's log file:
Apr 23 09:01:16 firewall ipmon[105]: 09:01:15.236653 2x qe0 @0:18 b x.x.x.x,67 -> 255.255.255.255,68 PR udp len 20 N
Looks like BOOTP/DHCP. You did read up on them like you were told to?
1. the rule is at the very top in ipf.conf, and I use "quick" on all my rules save the last one, so why is there "@0:18"?
Because rule 18 is the one causing the drop?
2. why is it still logging the drop?
Because you told it to?
Run ipfstat and look for rule 18.
-- Christopher Vance
