From owner-freebsd-net@FreeBSD.ORG  Thu Sep 14 15:09:35 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3027E16A412
	for <freebsd-net@freebsd.org>; Thu, 14 Sep 2006 15:09:35 +0000 (UTC)
	(envelope-from barney@databus.com)
Received: from mail1.acecape.com (mail1.acecape.com [66.114.74.12])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B3A2D43D49
	for <freebsd-net@freebsd.org>; Thu, 14 Sep 2006 15:09:34 +0000 (GMT)
	(envelope-from barney@databus.com)
Received: from pit.databus.com (pool-72-89-128-62.nycmny.fios.verizon.net
	[72.89.128.62]) (authenticated bits=0)
	by mail1.acecape.com (8.13.7/8.13.7) with ESMTP id k8EF930u025468
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Thu, 14 Sep 2006 11:09:03 -0400
Received: from pit.databus.com (localhost [127.0.0.1])
	by pit.databus.com (8.13.8/8.13.8) with ESMTP id k8EF92Kf023779;
	Thu, 14 Sep 2006 11:09:02 -0400 (EDT)
	(envelope-from barney@pit.databus.com)
Received: (from barney@localhost)
	by pit.databus.com (8.13.8/8.13.8/Submit) id k8EF92PZ023778;
	Thu, 14 Sep 2006 11:09:02 -0400 (EDT) (envelope-from barney)
Date: Thu, 14 Sep 2006 11:09:02 -0400
From: Barney Wolff <barney@databus.com>
To: Phil Regnauld <regnauld@catpipe.net>
Message-ID: <20060914150902.GA17230@pit.databus.com>
References: <4509592A.3040602@digiware.nl> <20060914134611.GW76403@catpipe.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20060914134611.GW76403@catpipe.net>
User-Agent: Mutt/1.5.11
X-Scanned-By: MIMEDefang 2.56 on 72.89.128.62
Cc: freebsd-net@freebsd.org, Willem Jan Withagen <wjw@digiware.nl>
Subject: Re: blocking a string in a packet using ipfw
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Sep 2006 15:09:35 -0000

On Thu, Sep 14, 2006 at 03:46:12PM +0200, Phil Regnauld wrote:
> Willem Jan Withagen (wjw) writes:
> > 
> > Now I'm pretty shure that ipfw does not stretch indefinitely to contain
> > perhaps something like 100.000 ip-numbers (would be a nice test. :) )
> 
> 	Actually, it should.

I have over 600000 addresses in an ipfw table with no observable trouble.
But that rule is triggered only about 10000 times a day (part of a spam
blocker).

-- 
Barney Wolff         I never met a computer I didn't like.