HP-UX IPFilter Version 16 Administrator's Guide

To change the number of connections allowed by a keep limit rule:
1. Create a new rule identical to the current rule except for a different keep limit count.
When adding a new rule, IPFilter recognizes it as the update of an existing rule. Current
limit entries made by the old rule are updated with the new connection limit when a new
connection is processed. New connections are processed with the new rule.
For example, the original rule is:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any keep limit 10 cumulative
To decrease the limit to 5, add the following new rule:
pass in quick proto tcp from 14.13.45.0-14.13.45.255 to any keep limit 5 cumulative
DCA detects a similar rule in the ruleset, but the limit count has changed. DCA updates the limit
count in the original rule and waits until the current number of connections drops to 5. During
this period, DCA does not allow any new connections, but it does not terminate any existing
connections. When the number of active connections drops to 5, DCA allows 5 or fewer
connections from the specified IP address range. If you increase a connection limit from a specified
IP address from 15 to 20, DCA detects the change and allows up to 20 connections from the
specified IP address.
If you increase the connection limit in a keep limit rule, DCA immediately updates the limit
count and controls connections based on the new higher connection limit.
Updating a Subnet or IP Address Range Rule
To update a subnet or IP address range keep limit rule:
1. Add the same rule, changing only the keep limit value. Be sure the subnet or IP address
range is identical to the old rule.
IPFilter recognizes the new rule as an update to an existing rule. IPFilter uses the new
connection limit instead of the old connection limit. Limit entries made by the old rule are
updated when a new connection is processed. New connections are processed with the new
rule.
Adding New keep limit Rules
The following procedures describe how to dynamically add new rules to active rules files.
To Add a New Individual keep limit Rule:
1. Add the new rule on the line before the old rule which the new rule is to replace.
2. Delete the old rule.
To Add a New Subnet or IP Address Range Rule:
1. Add the new rule on the line before the old rule which the new rule is to replace.
2. Delete the old rule.
Limit entries made by the old rule are updated when a new connection is processed. New
connections are processed with the new rule.
To add a more specific subnet or IP address range rule, see the following section, “Integrating
keep limit Rules” (page 51).
50 Configuring and Loading Dynamic Connection Allocation (DCA) Rules