HP-UX IPFilter A.03.05.13 Administrator's Guide: HP-UX 11i v3

Dynamic Connection Allocation
DCA Rule Modifications
Chapter 4 67
For example, the original rule is:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any
keep limit 10 cumulative
To decrease the limit to 5, add the following new rule:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any
keep limit 5 cumulative
DCA detects a similar rule in the ruleset, but the limit count has
changed. DCA updates the limit count in the original rule and waits until
the current number of connections drops to 5. During this period, DCA
does not allow any new connections, but it does not terminate any
existing connections. When the number of active connections drops to 5,
DCA allows 5 or fewer connections from the specified IP address range. If
you increase a connection limit from a specified IP address from 15 to 20,
DCA detects the change and allows up to 20 connections from the
specified IP address.
If you increase the connection limit in a keep limit rule, DCA
immediately updates the limit count and controls connections based on
the new higher connection limit.
Updating a Subnet or IP Address Range Rule
To update a subnet or IP address range keep limit rule:
1. Add the same rule, changing only the keep limit value. Be sure the
subnet or IP address range is identical to the old rule.
IPFilter recognizes the new rule as an update to an existing rule.
IPFilter uses the new connection limit instead of the old connection
limit. Limit entries made by the old rule are updated when a new
connection is processed. New connections are processed with the new
rule.
Adding New keep limit Rules
The following procedures describe how to dynamically add new rules to
active rules files.
To Add a New Individual keep limit Rule:
1. Add the new rule on the line before the old rule which the new rule is
to replace.