It is an excellent patch, however there is a problem with p0f-analyzer.

top - 04:36:22 up 14:34, 127 users,  load average: 1.00, 1.00, 1.00
Tasks: 408 total,   2 running, 404 sleeping,   2 stopped,   0 zombie
Cpu(s): 43.4%us, 15.4%sy,  0.1%ni, 35.8%id,  5.0%wa,  0.1%hi,  0.1%si,  
0.0%st
Mem:   3896000k total,  1969832k used,  1926168k free,        0k buffers
Swap:  8393920k total,       80k used,  8393840k free,   981784k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
  959 root      25   0  4676 2492 1760 R   99  0.1 871:05.39 p0f-analyzer.pl

It has been chewing CPU for a while, this script has bugs :(

A strace reveals:

select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])
time(NULL)                              = 1168162563
read(0, "", 1024)                       = 0
select(8, [0 3], NULL, NULL, NULL)      = 1 (in [0])


On Tue, 9 Jan 2007, Robert Felber wrote:

> On Wed, Jan 03, 2007 at 04:13:03PM +0200, Henrik Krohns wrote:
> > 
> > Hi, I whipped up a patch for policyd-weight-devel.
> > 
> > It adds p0f scoring support and greylisting (to be exact, user defined
> > postfix action) by some rules.
> 
> Thanks. Looks very interesting. I will dive in.
> 
> 
> -- 
>     Robert Felber (PGP: 896CF30B)
>     Munich, Germany
> 
> ____________________________________________________________
> Policyd-weight Mailinglist - http://www.policyd-weight.org/
> 

____________________________________________________________
Policyd-weight Mailinglist - http://www.policyd-weight.org/

Reply via email to