Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Explain a bit more how to examine the blacklist state.

Browse Source
This commit is contained in:
christos 2017-04-13 17:59:34 +00:00
parent 50dd7b358e
commit d72a6146c2
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
external/bsd/blacklist/README vendored
View File

@ -1,4 +1,4 @@
# $NetBSD: README,v 1.7 2015/01/26 00:34:50 christos Exp $
# $NetBSD: README,v 1.8 2017/04/13 17:59:34 christos Exp $
This package contains library that can be used by network daemons to
communicate with a packet filter via a daemon to enforce opening and
@ -98,6 +98,16 @@ group "internal" on $int_if {
...
}
You can use 'blacklistctl dump -a' to list all the current entries
in the database; the ones that have nfail <c>/<t> where <c>urrent
>= <t>otal, should have an id assosiated with them; this means that
there is a packet filter rule added for that entry. For npf, you
can examine the packet filter dynamic rule entries using 'npfctl
rule <rulename> list'. The number of current entries can exceed
the total. This happens because entering packet filter rules is
asynchronous; there could be other connection before the rule
becomes activated.
Enjoy,
christos