Re: IGMP with no matching rules

2013-05-04 Thread Florian Smeets
On 04.05.13 09:36, Jason Hellenthal wrote: > Hey Everyone, > > Has anyone seen IGMP traffic hit there pflog interface even if there > are no rules matching that tell it to log ? > > Anyone that has a pointer to eliminate the logging of the IGMP > traffic would be extremely helpful. This has been

Re: panic loading/enabling pf on ARM RELENG_9

2011-10-22 Thread Florian Smeets
On 23.10.11 00:06, John-Mark Gurney wrote: I'm trying to bring up an old Gateworks GW2348 board and get a panic when I have enabled pf and try to load rules at boot... The only modifications between the AVILA config file and mine is adding the pf, pflog and pfsync devices since AVILA doesn't hav

Re: PF NAT issue with 9.0-BETA3 and RELENG_9 'head'

2011-10-18 Thread Florian Smeets
On 18.10.11 18:44, Florian Wilkemeyer wrote: Hello, i recently switched a router in our test-environment to FreeBSD 9.0-Beta3 (and after things didnt worked ... checked out the current RELENG_9 and recompiled kernel& world .. ) Problem: After 5 - 15 minutes NAT stops working (normal routin

Re: 9-BETA3 "current entries" growing indefinitely

2011-10-04 Thread Florian Smeets
On 04.10.11 23:06, Bradley W. Dutton wrote: Hi, I just updated an 8-STABLE box to 9-BETA3 and have a problem where PF keeps growing the "current entries" indefinitely. I saw another person with a similar issue: http://groups.google.com/group/mailing.freebsd.current/browse_thread/thread/f350be446

Re: svn commit: r223637 - in head: . contrib/pf/authpf contrib/pf/ftp-proxy contrib/pf/man contrib/pf/pfctl contrib/pf/pflogd sbin/pflogd sys/conf sys/contrib/altq/altq sys/contrib/pf/net sys/modules

2011-09-09 Thread Florian Smeets
On 19.08.11 11:45, Florian Smeets wrote: On 19.08.2011 01:34, Pierre Lamy wrote: I just found how to resolve the problem (1 minute ago) as I was also having the same issue. If you compile pf into the kernel, state removals are NOT performed at all. pftop will show you garbage null entries

Re: svn commit: r223637 - in head: . contrib/pf/authpf contrib/pf/ftp-proxy contrib/pf/man contrib/pf/pfctl contrib/pf/pflogd sbin/pflogd sys/conf sys/contrib/altq/altq sys/contrib/pf/net sys/modules

2011-08-19 Thread Florian Smeets
On 19.08.2011 01:34, Pierre Lamy wrote: I just found how to resolve the problem (1 minute ago) as I was also having the same issue. If you compile pf into the kernel, state removals are NOT performed at all. pftop will show you garbage null entries. Flushing current states works for real states,

Re: svn commit: r223637 - in head: . contrib/pf/authpf contrib/pf/ftp-proxy contrib/pf/man contrib/pf/pfctl contrib/pf/pflogd sbin/pflogd sys/conf sys/contrib/altq/altq sys/contrib/pf/net sys/modules

2011-08-17 Thread Florian Smeets
On 17.08.2011 14:58, Ermal Luçi wrote: On Wed, Aug 17, 2011 at 2:37 PM, Florian Smeets wrote: On 17.08.2011 14:30, Bjoern A. Zeeb wrote: On Aug 17, 2011, at 12:27 PM, Florian Smeets wrote: On 08.07.2011 19:02, David O'Brien wrote: On Fri, Jul 08, 2011 at 02:26:37PM +0200, Ermal Lui

Re: svn commit: r223637 - in head: . contrib/pf/authpf contrib/pf/ftp-proxy contrib/pf/man contrib/pf/pfctl contrib/pf/pflogd sbin/pflogd sys/conf sys/contrib/altq/altq sys/contrib/pf/net sys/modules

2011-08-17 Thread Florian Smeets
On 17.08.2011 14:30, Bjoern A. Zeeb wrote: On Aug 17, 2011, at 12:27 PM, Florian Smeets wrote: On 08.07.2011 19:02, David O'Brien wrote: On Fri, Jul 08, 2011 at 02:26:37PM +0200, Ermal Lui wrote: On Thu, Jul 7, 2011 at 9:35 PM, David O'Brien wrote: I have 'pfctl', &#x

Re: svn commit: r223637 - in head: . contrib/pf/authpf contrib/pf/ftp-proxy contrib/pf/man contrib/pf/pfctl contrib/pf/pflogd sbin/pflogd sys/conf sys/contrib/altq/altq sys/contrib/pf/net sys/modules

2011-08-17 Thread Florian Smeets
On 08.07.2011 19:02, David O'Brien wrote: On Fri, Jul 08, 2011 at 02:26:37PM +0200, Ermal Lui wrote: On Thu, Jul 7, 2011 at 9:35 PM, David O'Brien wrote: I have 'pfctl', 'netstat', 'netstat -rn', and 'sysctl -a' output from one of these experiences. �Would they be useful to you in looking into

Re: default snaplen on tcpdump

2008-02-28 Thread Florian Smeets
Mike Tancsa wrote: Is there any chance of changing the default snap length of tcpdump to be a few bytes bigger ? With pf on RELENG_7, the default of 96 is too short now. So doing just a # tcpdump -nei pflog0 tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppres

Re: kern/117827: [pf] kernel panic with pf and ng

2007-12-30 Thread Florian Smeets
The following reply was made to PR kern/117827; it has been noted by GNATS. From: Florian Smeets <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Cc: Subject: Re: kern/117827: [pf] kernel panic with pf and ng Date: Sun, 30 Dec 2007 16:27:36 +0100 Hi, Max has submitted a

Re: ALTQ for dynamic interfaces [Re: 7-STABLE panic: mtx_lock() of spin mutex %s @ %s:%d]

2007-11-27 Thread Florian Smeets
Max Laier wrote: Okay ... try this. Not final yet, but should be functional. With this you should be able to: 1) Safely remove an interface with active queues 2) Re-add the interface and *magically* get the queues back 3) Write queue rules for non-existing interfaces - Note that we wil

Re: 7-STABLE panic: mtx_lock() of spin mutex %s @ %s:%d

2007-11-27 Thread Florian Smeets
Max Laier wrote: On Tuesday 27 November 2007, Florian Smeets wrote: Hi i was able to reproduce a hang on a 7-STABLE (csuped just after Scotts critical section MFC) firewall which runs mpd4 from ports and uses pf for packet filtering. Sometimes when i restart mpd4 the box just hangs. I have a

7-STABLE panic: mtx_lock() of spin mutex %s @ %s:%d

2007-11-26 Thread Florian Smeets
Hi i was able to reproduce a hang on a 7-STABLE (csuped just after Scotts critical section MFC) firewall which runs mpd4 from ports and uses pf for packet filtering. Sometimes when i restart mpd4 the box just hangs. I have a up-script which calls /sbin/pfctl -f /etc/pf.conf. After adding wit