Hi! > I wrote "ttl 10" because when the packet first hits, I want the entry to be > kept it the state table for 10 seconds, since the offending host keeps > sending packets almost every second.
That's not what TTL means. TTL is a field in IP packet header which indicates how many more routers this packet can traverse before it is dropped. It's designed so that packets wihich cannot be delivered anywhere and remain in the routing loop somewhere won't remain circulating on the net forever. Each router that forwards the packet decreases the TTL by one and when TTL reaches zero the packet is discarded. By specifying 'ttl 10' in your IPF rule, you say you want to only match those packets whose TTL field equals to 10. Plus, I'm still thinking 'keep state' can't be used with 'block'. -- Toomas Aas | [EMAIL PROTECTED] | http://www.raad.tartu.ee/~toomas/ * Cross country skiing is great if you live in a small country.
