> > Hello, > > I am using ipfilter 4.1.8 on FreeBSD 5.4-RELEASE-p8. > > Log first logs the first packet (no information about the connection > packet counts etc) and log all logs the all packets of connection > (very high system loads for log server, think of database logging or > other log analysis systems etc...). > > How can i log first 1000 packet of a connection? > OR log first and last packet OR log first packet+some packet > counters....
If you want packet/data counts for state, you should tell ipmon to collect state log information as well. Add "-o S" to the flags you start ipmon with. Or just use -a (that will get filter, NAT and state log information.) Darren
