[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Logging when max-src-states hit
- To: misc_(_at_)_openbsd_(_dot_)_org
- Subject: Logging when max-src-states hit
- From: Daniel Hamlin <hamlin_(_at_)_rose-hulman_(_dot_)_edu>
- Date: Mon, 07 Feb 2005 13:52:52 -0500
Is there a way to generate a log when a connection is denied due to a
host exhausting it's max-src-states?
For example, this rule limits my computer to 10 connections:
pass out log quick on $ext_if from <my IP> to any keep state
(max-src-states 10)
During testing, I was limited to 10 connections, as expected. I would
like to be able to log when the subsequent connections are dropped, for
troubleshooting and tuning purposes. I am able to get general src-state
statistics, but nothing specific to indicate that a connection between
two hosts was dropped because the max-src-states had been exhausted.
pfctl -vsS is useful to see how many states are currenlty active per
host, but I hate to run this command periodically in a polling-type
fashion to figure out whether or not my max-src-states is high enough.
I've searched MARC (max-src-states) but didn't find anything applicable.
Thanks for any info/pointers.
Dan Hamlin
Visit your host, monkey.org