OK, so every night the default install of FreeBSD generates a "security run output" report for IPF denied packets. Here is a sample report;
> 221143 @2 block out log quick on dc0 from any to any head 15 > 92733 @2 block in log quick on dc0 from any to any head 10 > 20 @8 block in log quick on dc0 from 10.0.0.0/8 to any group 10 That's it. I am looking at this and trying to figure out if it is useful and just what are those numbers for? I have IPF creating a log entry for all of the dropped packets, but when I look at the logs I can't match those numbers at all. In fact, if I do a 'wc -l' on the log file I get a count of 10,780 lines. If I take into account the log entries that have a consecutive count logged I come up with 11,422. Not even close the numbers listed above. So just what does this report mean and is there a better tool to run that would give me a nightly report of total drops and perhaps the top ten offenders and why? Thanks Tim _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
