HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3

Dynamic Connection Allocation
DCA Rule Modifications
Chapter 466
2. Run the following command to switch the active rules file with the
inactive rules file you modified:
ipf -s
When you modify an inactive rules file, then switch it with an active
rules file, DCA processes new connections according to the new rules file
whether or not there are existing connection limit entries in the limit
table.
TIP For performance-critical applications, HP recommends that you load
rules into the inactive list, then switch the inactive rules file with the
active rules file.
Updating keep limit Rules
The following sections describe procedures for updating keep limit
rules.
Changing the Current Individual, Subnet, or IP Address Range
Rule
You can dynamically lower the number of connections a keep limit rule
allows without letting DCA pass unwanted packets while it activates the
updated rules. You can also increase the connection limit for an IP
address, subnet, or IP address range.
For example, your IPFilter system has many connections coming from a
specific IP address range. You have a keep limit rule configured for
that IP address range. You want to lower the connection limit in the rule
so that DCA starts using the new limit immediately, before more packets
from the suspect IP address range can pass through.
To change the number of connections allowed by a keep limit rule:
1. Create a new rule identical to the current rule except for a different
keep limit count.
When adding a new rule, IPFilter recognizes it as the update of an
existing rule. Current limit entries made by the old rule are updated
with the new connection limit when a new connection is processed.
New connections are processed with the new rule.