HP-UX IPFilter V17.05 Administrator Guide HP-UX 11i v2 and HP-UX 11i v3

1. Create a new rule identical to the current rule except for a different keep limit count.
When adding a new rule, IPFilter recognizes it as the update of an existing rule. Current limit
entries made by the old rule are updated with the new connection limit when a new connection
is processed. New connections are processed with the new rule.
For example, the original rule is:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any keep limit 10 cumulative
To decrease the limit to 5, add the following new rule:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any keep limit 5 cumulative
DCA detects a similar rule in the ruleset, but the limit count has changed. DCA updates the limit
count in the original rule and waits until the current number of connections drops to 5. During this
period, DCA does not allow any new connections, but it does not terminate any existing connections.
When the number of active connections drops to 5, DCA allows 5 or fewer connections from the
specified IP address range. If you increase a connection limit from a specified IP address from 15
to 20, DCA detects the change and allows up to 20 connections from the specified IP address.
If you increase the connection limit in a keep limit rule, DCA immediately updates the limit
count and controls connections based on the new higher connection limit.
5.9.1.2 Updating a subnet or IP address range rule
To update a subnet or IP address range keep limit rule:
1. Add the same rule, changing only the keep limit value. Be sure the subnet or IP address
range is identical to the old rule.
IPFilter recognizes the new rule as an update to an existing rule. IPFilter uses the new connection
limit instead of the old connection limit. Limit entries made by the old rule are updated when
a new connection is processed. New connections are processed with the new rule.
5.9.2 Adding new keep limit rules
The following procedures describe how to dynamically add new rules to active rules files.
5.9.2.1 Adding a new individual keep limit rule
1. Add the new rule on the line before the old rule which the new rule is to replace.
2. Delete the old rule.
5.9.2.2 Adding a new subnet or IP address range rule
1. Add the new rule on the line before the old rule which the new rule is to replace.
2. Delete the old rule.
Limit entries made by the old rule are updated when a new connection is processed. New
connections are processed with the new rule.
To add a more specific subnet or IP address range rule, see the following section, Section 5.9.3
(page 39).
5.9.3 Integrating keep limit rules
The following procedure describes how to add a specific subnet or IP address range rule before
an existing general subnet or IP address range rule.
1. Add the new subnet or IP address range rule. Be sure to re-enter the old subnet or IP address
range rule exactly as it was entered before.
When a new connection matches an existing limit entry, the new connection will be processed
by the new subnet or IP address range rule. The subnet or IP address range can be cumulative
or noncumulative.
5.9 Loading and modifying DCA rules 39