From owner-freebsd-questions@FreeBSD.ORG  Mon Oct 25 13:35:49 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B586D16A54F
	for <freebsd-questions@freebsd.org>;
	Mon, 25 Oct 2004 13:35:49 +0000 (GMT)
Received: from mx.tele-kom.ru (mx.tele-kom.ru [213.80.148.6])
	by mx1.FreeBSD.org (Postfix) with SMTP id 9063043D5E
	for <freebsd-questions@freebsd.org>;
	Mon, 25 Oct 2004 13:35:33 +0000 (GMT)
	(envelope-from doublef@tele-kom.ru)
Received: (qmail 30290 invoked by uid 555); 25 Oct 2004 13:38:52 -0000
Received: from shark (213.80.148.231)
	by t-k.ru with TeleMail/2 id 1098711530-30197
	for freebsd-questions@freebsd.org;
	Mon, 25 Oct 17:38:50 2004 +0400 (MSD)
Received: by shark (Postfix, from userid 1000)
	id 2D48A38C; Mon, 25 Oct 2004 17:34:44 +0400 (MSD)
Date: Mon, 25 Oct 2004 17:34:43 +0400
From: Sergey Zaharchenko <doublef@tele-kom.ru>
To: Spades <spades@galaxynet.org>
Message-ID: <20041025133443.GA6371@shark.localdomain>
Mail-Followup-To: Sergey Zaharchenko <doublef@tele-kom.ru>,
	Spades <spades@galaxynet.org>, freebsd-questions@freebsd.org
References: <057501c4ba7d$d65a7fb0$0300a8c0@astral>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="SLDf9lqlvOQaIe6s"
Content-Disposition: inline
In-Reply-To: <057501c4ba7d$d65a7fb0$0300a8c0@astral>
User-Agent: Mutt/1.4.2.1i
X-Listening-To: /Machina_Vremeni/Tihiye_pesni
cc: freebsd-questions@freebsd.org
Subject: Re: ipfw flooding in /var/log/ipfw.log
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Oct 2004 13:35:50 -0000


--SLDf9lqlvOQaIe6s
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Oct 25, 2004 at 06:31:49PM +0800,
 Spades probably wrote:
>=20
> this is my ipfw.rule for now
> # ipfw add 900 allow log all from any to any
>=20
<snip>
>=20
> It will keep spitting this 2 lines as long i'm connected, how do i make
> it such as it will log only one instance?
>=20

You might want to change the rule to

# ipfw add 900 allow log all from any to any setup
                                             ^^^^^
which only logs the (attempts to) set up a connection (the initail SYN
packets). man ipfw has some interesting information on this.

HTH,


--=20
DoubleF
It is illegal to say "Oh, Boy" in Jonesboro, Georgia.

--SLDf9lqlvOQaIe6s
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFBfQDxwo7hT/9lVdwRAkADAJ946N/rRZGialjLRxHfH+jCcEHwBgCggHTh
U7YARz+3yUwRQaJrW1LPT0o=
=p7zR
-----END PGP SIGNATURE-----

--SLDf9lqlvOQaIe6s--