Darren Reed wrote:
The way ipfstat outputs line numbers does not match that for countingI assume this is on the list of things to fix even if it isn't high on that list. The manual page for ipmon says that the numbers should match. "These [rule numbers] can be viewed with ipfstat -n."
rules when stepping through to the one reported in the log output.
It's off by one - the rule @0:12 relates to is @13. Does that make
more sense for you ?
Um.. No. Not really. I have the following rules and output from ipmon.
bash-2.05b# ipfstat -in
@1 block in log on ep0 all
@2 block in log quick on ep0 from 193.226.8.108/32 to 203.79.72.166/32
@3 block in log quick on ep0 from 81.84.0.0/16 to 203.79.72.166/32
@4 block in log quick on ep0 from 24.93.161.154/32 to 203.79.72.166/32
@5 block in log quick on ep0 from 222.152.214.222/32 to 203.79.72.166/32
@6 pass in quick on ep0 proto tcp from any to 203.79.72.166/32 port = ssh flags S/FSRPAU keep state
@7 pass in quick on ep0 proto tcp from any to 203.79.72.166/32 port = smtp flags S/FSRPAU keep state
@8 pass in quick on ep0 proto tcp from any to 203.79.72.166/32 port = www flags S/FSRPAU keep state
@9 pass in quick on ep0 proto tcp from any to 203.79.72.166/32 port = https flags S/FSRPAU keep state
@10 pass in quick on ep0 proto tcp from any to 203.79.72.166/32 port = imaps flags S/FSRPAU keep state
@11 pass in quick on ep0 proto tcp/udp from any to 203.79.72.166/32 port = domain keep frags
@12 pass in quick on ep0 from 203.109.146.40/32 to any keep frags
@13 pass in quick proto icmp from any to any keep state
@14 pass in on tlp0 all
@15 pass in on lo0 all
@16 pass in quick on ep0 proto tcp from any to 10.0.1.25/32 port = 13951 flags S/FSRPAU keep state
bash-2.05b# ipmon
09/12/2004 08:42:35.318297 lo0 @0:13 b 127.0.0.1 -> 127.0.0.1 PR icmp len 20 84 icmp echoreply/0 K-S IN
09/12/2004 08:42:36.323418 lo0 @0:13 b 127.0.0.1 -> 127.0.0.1 PR icmp len 20 28 icmp echoreply/0 K-S IN low-ttl
09/12/2004 08:42:36.323471 lo0 @0:13 b 127.0.0.1 -> 127.0.0.1 PR icmp len 20 84 icmp echoreply/0 K-S IN
-- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.289 / Virus Database: 265.4.7 - Release Date: 7/12/2004
