Hi! > There is an offending host which keeps sending me packets every second or > so. The ruleset used to block it and log it accordingly. I have logging > configured through the syslog facility - "log first level local2.info". > However, since the offending host is filling up the log file, I just want to > drop the packet(s) without logging the event(s). > > Therefore, as a test, I put in as the very first line in ipf.conf: > > block in quick on qe0 ttl 10 from <offending host's IP>/32 to any keep state
I don't think 'keep state' makes any sense with 'block'. Maybe this rule doesn't even get applied. Does ipfstat -i show it? -- Toomas Aas | [EMAIL PROTECTED] | http://www.raad.tartu.ee/~toomas/ * 'Ome is where you 'ang your @
