HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3
Table Of Contents
- HP-UX IPFilter Version A.03.05.13 Administrator's Guide
- Legal Notices
- Table of Contents
- Preface: About This Document
- 1 Installing and Configuring HP-UX IPFilter
- Overview of HP-UX IPFilter Installation
- Step 1: Checking HP-UX IPFilter Installation Prerequisites
- Step 2: Loading HP-UX IPFilter Software
- Step 3: Determining the Rules for IPFilter
- Step 4: Adding Rules to the Rules Files
- Step 5: Loading IPFilter and NAT Rules
- Step 6: Verifying the Installation and Configuration
- Kernel Tunable Parameters
- Supported and Unsupported Interfaces
- Troubleshooting HP-UX IPFilter
- 2 HP-UX IPFilter on HP-UX 11i Version 3
- 3 Rules and Keywords
- IPFilter Configuration Files
- Basic Rules Processing
- IPFilter Keywords
- pass and block: Controlling IP Traffic
- in and out: Bidirectional Filtering
- quick: Optimizing IPFilter Rules Processing
- on: Filtering by Network Interfaces
- from and to: Filtering by IP Addresses and Subnets
- log: Tracking Packets on a System
- proto: Controlling Specific Protocols
- opt and ipopts: Filtering on IP Options
- icmp-type: Filtering ICMP Traffic by Type
- port: Filtering on TCP and UDP Ports
- keep state: Protecting TCP, UDP, and ICMP Sessions
- flags: Tight Filtering Based on TCP Header Flags
- keep frags: Letting Fragmented Packets Pass
- with frags: Dropping Fragmented Packets
- with short: Dropping Short Fragments
- return-rst: Responding to Blocked TCP Packets
- return-icmp: Responding to Blocked ICMP Packets
- dup-to: Drop-Safe Logging
- NAT Keywords
- 4 Dynamic Connection Allocation
- 5 Firewall Building Concepts
- Blocking Services by Port Number
- Using Keep State
- Using Keep State with UDP
- Using Keep State with ICMP
- Logging Techniques
- Improving Performance with Rule Groups
- Localhost Filtering
- Using the to
- Creating a Complete Filter by Interface
- Combining IP Address and Network Interface Filtering
- Using Bidirectional Filtering Capabilities
- Using port and proto to Create a Secure Filter
- 6 HP-UX IPFilter Utilities
- 7 HP-UX IPFilter and FTP
- 8 HP-UX IPFilter and RPC
- 9 HP-UX IPFilter and IPSec
- 10 HP-UX IPFilter and Serviceguard
- A HP-UX IPFilter Configuration Examples
- B HP-UX IPFilter Static Linking
- C Performance Guidelines
- Index

Dynamic Connection Allocation
DCA Keywords
Chapter 4 61
In the example summary log, the source IP address displayed is actually
the IP address range specified in the rule. Wildcard IP addresses are
shown as 0.0.0.0. The destination port information is also printed from
the rule. The other fields are similar to a non-cumulative summary
record.
For further information, see “ipmon and DCA Logging” on page 103.
log limit freq: Log Frequency
Use the log limit freq
<num>
keyword to control the frequency at
which alert log records are logged.
For example, log limit is set to 10 and log limit freq is set to 3. The
system begins tracking exceeded connections at the eleventh connection.
It logs every third exceeded connection, that is the fourteenth,
seventeenth, twentieth, and so on.
The log limit freq keyword can also be used with keep limit
cumulative rules. For example:
pass in log limit freq 5 quick proto tcp from 18.9.90.0/24 to
any keep limit 10 cumulative
In the previous rule, log limit freq 5 specifies that the log records
should be printed for every five connections that exceeds the connection
limit of 10. If 100 connections came in, it logs the eleventh, sixteenth,
twenty-first, and so on.
Cumulative limits are shared by different IP addresses and it is possible
that connections from some source IPs will not display. For example, the
initial connections might come from IP1 and the next 10 from IP2. IP1
will not be logged, but IP2 will be logged, as one of its connections will be
the eleventh connection.