> Did you restart ipf? Why did you say 'ttl 10'? You shouldn't see > traffic to 255.255.255.255 except from hosts on your immediate > network.
It is on my "immediate network". I suspect it's a machine of my ISP, and I don't know why, but it's been sending BOOTP requests for almost two years now. I finally got fed up with it clogging my log files, so I decided to do something about it (meanwhile, my equipment's been in storage for a year before bringing it all online again, which is why I didn't do it sooner.) Be that as it may, I did `ipf -FaS; ipf -vf /etc/opt/ipf/ipf.conf`. I wrote "ttl 10" because when the packet first hits, I want the entry to be kept it the state table for 10 seconds, since the offending host keeps sending packets almost every second. I figured that any subsequent packets from the same host would get dropped without any further processing because the connection is already in the state table, so ipf would only create 1/10th or less connections. Did I figure wrong? > Looks like BOOTP/DHCP. You did read up on them like you were told to? It is BOOTP, but why is that relevant? It was someone else who asked about DHCP. > Because rule 18 is the one causing the drop? Exactly, and should be the first rule in ipf.conf! > Because you told it to? That's exactly my point, I specified @1 "block in quick on qe0 ttl 10 from x.x.x.x/32 to any keep state", I didn't specify "log" or "log first", so why is it getting logged??? > Run ipfstat and look for rule 18. "@18 block in log first level local2.info quick from any to any" So it's the cleanup rule, which means it's not getting a hit on rule #1. Why??? Back to the drawing board.
