Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 26 Jul 1999 11:47:20 -0700 (PDT)
From:      Matthew Dillon <>
To:        Joe Greco <>
Cc:        freebsd-hackers@FreeBSD.ORG, freebsd-ipfw@FreeBSD.ORG
Subject:   Re: securelevel and ipfw zero
Message-ID:  <>
References:   <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
:So, I've a box that I have an ipfw ruleset on.  The firewall should not be
:changeable during runtime, and the box runs at securelevel=3.
:In order to prevent DoS disk-fill attacks, I also have specified
:Now, the problem is, in securelevel 3, you cannot zero a rule's counter,
:so basically once you are up and running, you get to log IPFW_VERBOSE_LIMIT
:events and then you lose logging (ideally I'd zero nonzero rules once every
:N minutes).
:... Joe
:Joe Greco - Systems Administrator

    Playing devil's advocate, someone might be using those counters for
    accounting purposes.  That's about as worse a scenario as I can think
    of, and I can't imagine this sort of situation would be prevalient.

    I'd say that the counters should be clearable at high secure level.

					Matthew Dillon 

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>