HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index

HP-UX IPFilter Utilities
The ipfstat Utility
Chapter 6 99
• Log Failures is the number of times log entries have not been
logged. A non-zero, positive value for Log Failures indicates that
the size of the kernel log buffer is small. The kernel log buffer
ipl_buff_sz should be set to an appropriate value.
• Limits Added is the number of limit entries that have been added.
• Add Failures is the number of times a limit entry could not be
created. This happens when a state entry is not added. The output of
ipfstat -s should be used to further diagnose the problem.
These statistics are cumulative. They are automatically reset to zero
when the ipf module is unloaded and loaded again.
See “Kernel Tunable Parameters” on page 14 for more information on
setting the size of the state table, limit table, and log buffer.
The following is an example of the output information of the ipfstat
-v-L option:
Type Rule Src IP Src Port Dest IP Dest Port Limit Current
S @0:3 10.39.1.2 * 10.133.1.5 80 50000 951 (0)
S @0:1 10.2.1.2 * 10.129.1.5 80 50000 942 (0)
U @0:1000 10.30.1.2 * 10.130.1.5 80 10 10(102)
U @0:1000 10.30.1.3 * 10.130.1.5 80 10 9 (501)
U @0:1000 10.30.1.4 * 10.130.1.5 80 10 10(100)
U @0:1000 10.30.1.5 * 10.130.1.5 80 10 10(118)
U @0:1000 10.30.1.6 * 10.130.1.5 80 10 10(196)
U @0:1000 10.30.1.7 * 10.130.1.5 80 10 10(198)
U @0:1000 10.30.1.8 * 10.130.1.5 80 10 10(104)
U @0:1000 10.30.1.0 * 10.130.1.5 80 10 10(111)
U @0:1000 10.49.1.2 * 10.131.1.5 80 10 10 (55)
U @0:1000 10.49.1.3 * 10.131.1.5 80 10 10 (53)
U @0:1000 10.49.1.4 * 10.131.1.5 80 10 10(102)
U @0:1000 10.49.1.5 * 10.131.1.5 80 10 9 (52)
U @0:1000 10.49.1.6 * 10.131.1.5 80 10 9 (52)
U @0:1000 10.49.1.7 * 10.131.1.5 80 10 10(103)
U @0:1000 10.49.1.8 * 10.131.1.5 80 10 10(120)
U @0:1000 10.49.1.9 * 10.131.1.5 80 10 10(50)
S @0:1000 10.40.1.2 * 10.134.1.5 80 50000 943(0)
U @0:1000 10.46.1.2 * 10.128.1.5 80 10 10 (49)
U @0:1000 10.46.1.3 * 10.128.1.5 80 10 10 (41)
• The Type column displays the type of limit being kept:
I—Fully resolved individual IP
S—IP subnet