From owner-freebsd-questions@FreeBSD.ORG Wed Aug 22 15:21:57 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1B8B716A420 for ; Wed, 22 Aug 2007 15:21:57 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail4.sea5.speakeasy.net (mail4.sea5.speakeasy.net [69.17.117.6]) by mx1.freebsd.org (Postfix) with ESMTP id EA3E813C46B for ; Wed, 22 Aug 2007 15:21:56 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: (qmail 19754 invoked from network); 22 Aug 2007 15:21:56 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail4.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 22 Aug 2007 15:21:56 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 06CF12843A; Wed, 22 Aug 2007 11:21:54 -0400 (EDT) To: Grant Peel References: <037d01c7e32b$0c8d3c70$6501a8c0@GRANT> From: Lowell Gilbert Date: Wed, 22 Aug 2007 11:21:54 -0400 In-Reply-To: <037d01c7e32b$0c8d3c70$6501a8c0@GRANT> (Grant Peel's message of "Mon\, 20 Aug 2007 09\:07\:23 -0400") Message-ID: <44mywjd27h.fsf@be-well.ilk.org> User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.99 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: freebsd-questions@freebsd.org Subject: Re: IPFW Questions. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2007 15:21:57 -0000 "Grant Peel" writes: > I was wondering what the concensus is on using dynamic rules in IPFW. Every once in a while, I suppose there is a DoS attaclk that causes me to see hundreds of: > > +ipfw: install_state: Too many dynamic rules > > in my security log. > > I am sure i read somewhere that many people are skipping the dynamic rules and just relying on the line by line rules. > > You thoughts please. You shouldn't allow people outside the network to invoke a dynamic rule; that's a limited resource that they can overwhelm, as you see. Usual practice is to set up state only on already-confirmed connections; in my case, that means only outbound packets that didn't match any previous state. > Any while your up, does anyone really know what this means? > > ipfw: pullup failed > > I dont see that often maybe 1 or 2 times a month. A "pullup" is just advancing deeper into the packet. If it failed, that probably means the packet was too short. Truncated packets can happen for a number of benign reasons, but if they happen frequently they're probably a sign of a problem in your network equipment. By "frequently" I mean several orders of magnitude more than you're seeing them. Don't worry about it.