From owner-freebsd-ipfw@FreeBSD.ORG Wed Sep 13 04:07:17 2006 Return-Path: X-Original-To: ipfw@freebsd.org Delivered-To: freebsd-ipfw@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1B94116A407 for ; Wed, 13 Sep 2006 04:07:17 +0000 (UTC) (envelope-from fcash@ocis.net) Received: from smtp.sd73.bc.ca (mailtest.sd73.bc.ca [142.24.13.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 929FD43D46 for ; Wed, 13 Sep 2006 04:07:16 +0000 (GMT) (envelope-from fcash@ocis.net) Received: from localhost (localhost [127.0.0.1]) by localhost.sd73.bc.ca (Postfix) with ESMTP id A4E3C18CCB5; Tue, 12 Sep 2006 21:16:31 -0700 (PDT) X-Virus-Scanned: by amavisd-new using ClamAV at sd73.bc.ca Received: from smtp.sd73.bc.ca ([127.0.0.1]) by localhost (smtp.sd73.bc.ca [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 58hVYgeO5FBP; Tue, 12 Sep 2006 21:16:30 -0700 (PDT) Received: from webmail.sd73.bc.ca (unknown [10.10.10.17]) by smtp.sd73.bc.ca (Postfix) with ESMTP id 83A3D18CC82; Tue, 12 Sep 2006 21:16:25 -0700 (PDT) Received: from 24.71.118.34 (SquirrelMail authenticated user fcash) by webmail.sd73.bc.ca with HTTP; Tue, 12 Sep 2006 21:07:14 -0700 (PDT) Message-ID: <60554.24.71.118.34.1158120434.squirrel@webmail.sd73.bc.ca> In-Reply-To: <4507539A.5000502@lbl.gov> References: <4507539A.5000502@lbl.gov> Date: Tue, 12 Sep 2006 21:07:14 -0700 (PDT) From: "Freddie Cash" To: "Jin Guojun [VFFS]" User-Agent: SquirrelMail/1.5.1 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit Cc: ipfw@freebsd.org Subject: Re: maximum deny entries? X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Sep 2006 04:07:17 -0000 On Tue, September 12, 2006 5:40 pm, Jin Guojun [VFFS] wrote: > I am not sure if this is a bug or is there some limitation for total > deny entry, when the deny list exceeds a certain length (36 lines at > this case), ipfw stop working (see the *** line below). > > This is on 6.1-R i386 platform. > Is there know problem on this issue? or Did I made some mistake? > > Please CC to me since I am not on the list. Works fine here, with 62 deny rules out of 533 rules in total. While not every deny rule has a matched packet so far, the rules under them all work fine. ---- Freddie Cash fcash@ocis.net