new ipfilter option is really cool!I was reading the ipfilter mailing list today, when I read this message which talked about an option on ipfstat which I had not seen before. So I rushed off to man ipfstat where I found this:
-t Show the state table in a way similar to they way top(1) shows the process table. States can be sorted using a number of different ways. This options requires ncurses(3) and needs to be com- piled in. It may not be available on all operating systems. See below, for more information on the
I don’t know about you, but my first thought was: way cool! I tried it out, but failed. It wasn’t compiled into ipfilter. That’s when I did another build world. Which meant I upgraded the build work script. Have a read of Build world on your fast box, install on your slow box. I’ve added a few options and hopefully made it more useful.
What’s it look like?When you type ipfstat -t, you should see something like this (I’ve shrunk this slightly):
IP Filter: v3.4.16 - state top 22:38:03 Src = 0.0.0.0 Dest = 0.0.0.0 Proto = any Sorted by = # bytes Source IP Destination IP ST PR #pkts #bytes ttl 10.0.0.3,4378 188.8.131.52,6668 4/4 tcp 35310 3207948 119:59:57 10.0.0.3,4381 192.168.0.20,23 4/4 tcp 12610 1266318 119:59:59 10.0.5.5,1024 184.108.40.206,53 0/0 udp 14 1701 0:48 10.0.5.5,123 220.127.116.11,123 0/0 udp 4 304 0:44 18.104.22.168,53 10.0.5.5,53 0/0 udp 2 272 1:14 10.0.5.5,123 22.214.171.124,123 0/0 udp 2 152 0:57
This screen updates once per second. This can be interesting as you can see new connections arise and drop. It’s quite fascinating to watch. On the realistic side, this can be a valuable tool in debugging your filtering rules.
Compiling in ncurses support (added on 14 March 2001)BSDaemon wrote in with this very useful information:
So long as you’re running 3.4.x (ipf, some x version +) you most likely don’t need to make world, it’s already there, just not compiled in, nor in the man pages. Check the Makefile to be sure…
vi Makefile (uncomment three lines) :
mkdir netinet (if doesn't exist) otherwise won't compile and will just give errors.
No reboot, no kernel recompile, and no make world – I myself alteastdidn’t have to on any of my FreeBSD boxes, seeing as I was already running 3.4.x.
If running 3.3.x on the other hand, I think that would probly require either to simply download the latest ipf source, install, compile, etc.. But for anyone running stock 3.3.x ipf in FreeBSD, then that’s a sign that their FreeBSD box is probly running an older -RELEASE or -STABLE version. So I’d recommend they follow more on CERT advistories not to mention, following up on the freebsd-security mailing list and upgrade to latest -STABLE if possible IMHO.
This worked for me on all my FreeBSD boxes, but may not for some.. OpenBSD on the other hand was a whole different ball game, but working great on that too with some slight modifications.
Compiling in ncurses support – even faster (added on 28 March 2001)David Hill writes:
An easier way to add the "top" feature into ipfstat -t is to do this:
edit Makefile ; put in the 3 STATETOP_ lines
Yet faster still (added on 30 March 2001)Will Andrews writes:
make -DSTATETOP -DSTATETOP_INC="" -DSTATETOP_LIB="-lncurses" -DSTATETOP_CFLAGS="-DSTATETOP"
I would like to know the meaning of the ST column.
Does anybody knows ?
Oh sorry on http://home.earthlink.net/~jaymzh666/ipf/IPFques.html
under point 24 I’ve found the exact meaning of status column.
Thanks to that FAQ !