In some email I received from Lloyd Parkes, sie wrote: > I've been spending some time trying to work out why I can't ping on my > firewall. I guessed that something was very wrong when "ping 127.0.0.1" > didn't work. > > I finally convinced ipmon to tell me > > 22/11/2004 18:15:28.569062 lo0 @0:12 b 127.0.0.1 -> 127.0.0.1 PR icmp > len 20 84 icmp echoreply/0 K-S IN > > "ipfstat -in" tells me > > @12 pass in quick proto icmp from any to any keep state > > wtf. How can "pass in" block packets?
The way ipfstat outputs line numbers does not match that for counting rules when stepping through to the one reported in the log output. It's off by one - the rule @0:12 relates to is @13. Does that make more sense for you ? Darren
