From owner-freebsd-stable@FreeBSD.ORG Thu Aug 21 19:54:17 2008 Return-Path: Delivered-To: freebsd-stable@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EE5DF1065674 for ; Thu, 21 Aug 2008 19:54:17 +0000 (UTC) (envelope-from mi+mill@aldan.algebra.com) Received: from mail8.sea5.speakeasy.net (mail8.sea5.speakeasy.net [69.17.117.10]) by mx1.freebsd.org (Postfix) with ESMTP id C7FA98FC15 for ; Thu, 21 Aug 2008 19:54:17 +0000 (UTC) (envelope-from mi+mill@aldan.algebra.com) Received: (qmail 23375 invoked from network); 21 Aug 2008 19:54:17 -0000 Received: from aldan.algebra.com (HELO [127.0.0.1]) (mi@[216.254.65.224]) (envelope-sender ) by mail8.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 21 Aug 2008 19:54:17 -0000 Message-ID: <48ADC7E7.9030907@aldan.algebra.com> Date: Thu, 21 Aug 2008 15:54:15 -0400 From: Mikhail Teterin User-Agent: Thunderbird 2.0.0.16 (X11/20080707) MIME-Version: 1.0 To: Neil Neely References: <48ADA81E.7090106@aldan.algebra.com> In-Reply-To: Content-Type: text/plain; charset=KOI8-U; format=flowed Content-Transfer-Encoding: 8bit Cc: freebsd-security@freebsd.org, freebsd-stable@FreeBSD.org Subject: Re: machine hangs on occasion - correlated with ssh break-in attempts X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Aug 2008 19:54:18 -0000 Neil Neely ΞΑΠΙΣΑΧ(ΜΑ): > I haven't explored this issue enough to speak with any authority - but > once upon a time I had an app doing tons of ipfw rule add/removes all > the time and we had no end of performance and stability problems on > that box (this would have been in 4.x or so timeline I expect). As > that approach wasn't really critical we abandoned it without really > digging into the details. > > Years later a need for lots of rapid firewall changes came up again > and I drilled into it and found the use of tables was excellent for > doing this and it does the job very well. This is approach is on a > FreeBSD 6.3 box. > > ipfw add 00550 deny ip from 'table(1)' to any > > Then just add remove entries to table 1 via: > ipfw table 1 add 10.1.1.22/32 > ipfw table 1 delete 10.1.1.22/32 > > show all entries in table 1 with: > ipfw table 1 list > > Clear out the whole of table 1 > ipfw table 1 flush > > I can't be sure if this relates to your particular issue, but I would > recommend trying it out. Thanks! I was not even aware of this functionality... Yes, I'll try that -- maybe, a bug in ipfw only hits once per 1000 invocations :-) -mi