Subject: Re: ipf help
To: None <firstname.lastname@example.org>
From: David Maxwell <email@example.com>
Date: 12/13/1999 16:45:02
On Mon, Dec 13, 1999 at 03:19:15PM -0500, firstname.lastname@example.org wrote:
> I'm trying to block some particular network traffic. The stuff in
> question (from tcpdump) is:
> 15:16:24.311352 SEPTUM.MIT.EDU.1121 > 22.214.171.124.sunrpc: udp 96
Not related to your question, but should that machine really be
broadcasting to a whole b-class?
If you're not on the same subnet, bug your network admins to block
directed IP broadcasts. It'll also help prevent network abuse.
> So I put a line in /etc/ipf.conf:
> block in quick on ep1 from 126.96.36.199/16 to 188.8.131.52/32 port=sunrpc
> but this doesn't do it. I still see the packets with tcpdump and ipfstat
> doesn't show any blocked.
tcpdump will show you the packets even if they're blocked, because
tcpdump grabs them at the _ethernet_ level.
I think you need spaces around your '='.
David Maxwell, email@example.comfirstname.lastname@example.org -->
If you don't spend energy getting what you want,
You'll have to spend it dealing with what you get.