Custom kernel poll summary (was: Re: Reducing the need to compile a custom kernel)

[Freddie Cash]

On Tue, Feb 14, 2012 at 7:43 AM, Ian Smith <smithi at nimnet.asn.au> wrote:
> On Tue, 14 Feb 2012 2:37:55 +0100, Alexander Leidinger wrote:
>  > 1 IPSTEALTH                      -> changes ipfw module only?
>
> I don't think this is specific to ipfw.  From /sys/conf/NOTES:
>
> # IPSTEALTH enables code to support stealth forwarding (i.e., forwarding
> # packets without touching the TTL).  This can be useful to hide firewalls
> # from traceroute and similar tools.
>
> But can it be disabled once added to kernel?  It's no good as a default.

It's controllable via sysctl once it's compiled into the kernel.  If
it's not compiled into the kernel, then the sysctl doesn't exist.

>  > 1 IPFIREWALL_VERBOSE_LIMIT=5     -> changes ipfw module only?
>  >                                    loader tunable?

This is controllable via sysctl.  Not sure if it needs to be compiled
into the kernel before it's controllable via sysctl, though.   We have
compiled into all our firewall kernels (with a default of 1000), then
change it via sysctl when needed.

>  > 1 IPFIREWALL_VERBOSE             -> changes ipfw module only?
>  >                                    loader tunable?
>
> sysctl.conf: net.inet.ip.fw.verbose and net.inet.ip.fw.verbose_limit

Ah, you list the sysctls that control the last two.  :)

-- 
Freddie Cash
fjwcash at gmail.com