HP-UX IPFilter Version 17 Administrator's Guide

Subnet 3
Cumulative 5
Unknown IP 9
Total 19
No Memory 0
Logged Records 13
Log Failures 0
Limits Added 13
Add Failures 0
• The first six lines display the number of current active connections of each described type.
• No Memory is the number of times a limit entry could not be created because no memory
was available. If this is a non-zero, positive value, then the system memory should be checked
and, if necessary, increased.
• Logged Records is the number of limit entries logged, both summary and alert log records.
• Log Failures is the number of times log entries have not been logged. A non-zero, positive
value for Log Failures indicates that the size of the kernel log buffer is small. The kernel
log buffer ipl_buff_sz should be set to an appropriate value.
• Limits Added is the number of limit entries that have been added.
• Add Failures is the number of times a limit entry could not be created. This happens
when a state entry is not added. The output of ipfstat -s should be used to further
diagnose the problem.
These statistics are cumulative. They are automatically reset to zero when the ipf module is
unloaded and loaded again.
See Appendix C (page 143) for more information on setting the size of the state table, limit table,
and log buffer.
The following is an example of the output information of the ipfstat -vL option:
Type Rule Src IP Src Port Dest IP Dest Port Limit Current
S @0:3 10.39.1.2 * 10.133.1.5 80 50000 951 (0)
S @0:1 10.2.1.2 * 10.129.1.5 80 50000 942 (0)
U @0:1000 10.30.1.2 * 10.130.1.5 80 10 10(102)
U @0:1000 10.30.1.3 * 10.130.1.5 80 10 9 (501)
U @0:1000 10.30.1.4 * 10.130.1.5 80 10 10(100)
U @0:1000 10.30.1.5 * 10.130.1.5 80 10 10(118)
U @0:1000 10.30.1.6 * 10.130.1.5 80 10 10(196)
U @0:1000 10.30.1.7 * 10.130.1.5 80 10 10(198)
U @0:1000 10.30.1.8 * 10.130.1.5 80 10 10(104)
U @0:1000 10.30.1.0 * 10.130.1.5 80 10 10(111)
U @0:1000 10.49.1.2 * 10.131.1.5 80 10 10 (55)
U @0:1000 10.49.1.3 * 10.131.1.5 80 10 10 (53)
U @0:1000 10.49.1.4 * 10.131.1.5 80 10 10(102)
U @0:1000 10.49.1.5 * 10.131.1.5 80 10 9 (52)
U @0:1000 10.49.1.6 * 10.131.1.5 80 10 9 (52)
U @0:1000 10.49.1.7 * 10.131.1.5 80 10 10(103)
U @0:1000 10.49.1.8 * 10.131.1.5 80 10 10(120)
U @0:1000 10.49.1.9 * 10.131.1.5 80 10 10(50)
S @0:1000 10.40.1.2 * 10.134.1.5 80 50000 943(0)
U @0:1000 10.46.1.2 * 10.128.1.5 80 10 10 (49)
U @0:1000 10.46.1.3 * 10.128.1.5 80 10 10 (41)
• The Type column displays the type of limit being kept:
I—Fully resolved individual IP
S—IP subnet
C—Cumulative
U—Unknown IP
9.1 Viewing IPFilter Statistics and Active Rules with ipfstat 83